Security: n8n 2.15.0 ships axios 1.13.5 vulnerable to SSRF (CVE-2025-62718)

[noahxp]

Summary

n8n 2.15.0 bundles axios@1.13.5, which is affected by CVE-2025-62718 (GHSA-3p68-rc4w-qgx5, severity: Critical).

This is a Server-Side Request Forgery (SSRF) vulnerability caused by improper hostname normalization when evaluating the NO_PROXY environment variable. An attacker can craft requests that bypass NO_PROXY rules, potentially accessing internal network resources (e.g., cloud metadata endpoints).

Affected locations

The following paths in n8nio/n8n:2.15.0 contain axios@1.13.5:

• .pnpm/axios@1.13.5/node_modules/axios/
• .pnpm/axios@1.13.5_debug@4.4.3/node_modules/axios/

The task runner image n8nio/runners:2.15.0 is also affected:

• /opt/runners/task-runner-javascript/node_modules/.pnpm/axios@1.13.5/node_modules/axios/

Fix

Upgrade axios to 1.15.0 or later, which addresses this vulnerability.

• axios release: https://github.com/axios/axios/releases/tag/v1.15.0
• Fix PR: Fixes #10610 Deprecation Warning : url.parse() is deprecated in Node.… axios/axios#10625

References

• GHSA-3p68-rc4w-qgx5
• https://nvd.nist.gov/vuln/detail/CVE-2025-62718

[n8n-assistant]

Hey @noahxp,

Thank you for reaching out! We’ve received your issue and are looking into it. To help us track this internally, we’ve created a Linear ticket with the reference: "GHC-7676".

We’ll keep you updated as we make progress, but if you have any additional details or context to share, feel free to add them here - it’s always helpful!

Thanks for your patience and for bringing this to our attention.

---

For INTERNAL use only: GHC-7676