What is GHSA-38fj-36m5-783c?

GHSA-38fj-36m5-783c is a security advisory published by GitHub Security Advisories with Medium severity. Duplicate Advisory: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access

Why does GHSA-38fj-36m5-783c have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-38fj-36m5-783c?

GHSA-38fj-36m5-783c affects 1 product, including: npm/n8n:\u003c 1.123.64.

⚠ Withdrawn by GitHub Security Advisories

Withdrawn: July 22, 2026

GHSA-38fj-36m5-783cMediumDisclosed before NVD

Duplicate Advisory: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access

Vendor

GitHub Security Advisories

Published

July 22, 2026

Last Modified

July 22, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-9w78-79q7-r4fp. This link is maintained to preserve external references.

Original Description

n8n versions before 1.123.64 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing configuration to override baseURL restrictions and make the n8n server issue HTTP requests to arbitrary internal targets when SSRF protection is disabled.

🎯 Affected products1

npm/n8n:< 1.123.64

🔗 References (4)

https://github.com/n8n-io/n8n/security/advisories/GHSA-9w78-79q7-r4fp
https://nvd.nist.gov/vuln/detail/CVE-2026-65593
https://www.vulncheck.com/advisories/n8n-before-ssrf-via-dynamic-node-parameters
https://github.com/advisories/GHSA-38fj-36m5-783c