Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.7
n8n may deliver extra data in partial responses
published 9 days ago
Summary
The n8n workflow tool uses a component that can mistakenly attach extra content to a response that was already partially sent, while still showing the original status and headers. This could cause incomplete or corrupted data to be processed by your automations. Update n8n to the latest version or apply the provided patch to stop the faulty behavior.
What to do
- Update cleanstart n8n to version 2.28.0-r5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | n8n |
< 2.28.0-r5 Fix: upgrade to 2.28.0-r5
|
Original advisory text
undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers
Security vulnerability affects the n8n package. undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published10 Oct 2026
Updated10 Oct 2026
First seen10 Oct 2026
Sources
CLEANSTART-2026-FA02454 · OSV
Track software like this
Free during beta