A server‑side request forgery flaw exists in n8n versions prior to 2.34.1. The legacy request helper function, which is accessible through Code and Function nodes, performs SSRF validation against the "uri" property. However, the underlying HTTP client actually uses the "url" property when both fields are supplied. Attackers can submit a safe value for "uri" while injecting malicious content into "url" to bypass the SSRF check, thereby allowing requests to internal network addresses. The vulnerability enables an attacker who can influence the node input, such as through an exposed automation workflow, to retrieve data from or interact with internal resources that the system normally would not expose externally.

The affected product is n8n from n8n‑io. All releases before version 2.34.1 are vulnerable. Users running those older versions should be aware that any automation leveraging Code or Function nodes that use the legacy request helper could be exploited.

The CVSS score of 5.3 categorizes this as a moderate severity risk. EPSS data is not available, so a precise exploitation probability cannot be determined, and the vulnerability is not listed in CISA’s KEV catalog. Likely exploitation requires an attacker who can inject payloads into the request helper call, such as by creating or modifying a workflow for the n8n instance. The flaw can lead to privileged internal network access or data exfiltration if the user executing the node has sufficient privileges.