CVE-2026-27496: n8n has In-Process Memory Disclosure in its Task Runner

An authenticated user with permission to create or modify workflows could use the JavaScript Task Runner to allocate uninitialized memory buffers. Uninitialized buffers may contain residual data from the same Node.js process — including data from prior requests, tasks, secrets, or tokens — resulting in information disclosure of sensitive in-process data.

• Task Runners must be enabled using N8N_RUNNERS_ENABLED=true.
• In external runner mode, the impact is limited to data within the external runner process.