CVE-2026-72766Published
n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does not enforce that its message fields are strings. A crafted non-string value supplied from a workflow …
Exact source revision recorded 25 Oct 2026 15:19:03 UTC. It does not establish the source's current position. Latest evidence.
nvd · CVE-2026-72766
PublishedNo affected-package array is stated in this source revision. Check its state and earlier observations; this does not establish that every package is unaffected.