What changed in the lean web stack

On 28 October n8n published at least ten advisories. They include two rated High (deprecated Code nodes allowing code execution in the main process, and an insecure GraphicsMagick configuration) and several Moderate issues, such as an OAuth account hijack in the credential connect flow, SQL injection in the OracleDB vector store node, and an open redirect via MCP OAuth client registration. This follows several critical n8n CVEs earlier in 2026, including CVE-2026-25049 in February.

Why it matters: Self-hosted n8n instances often hold many client credentials, so check the affected versions in each advisory and patch promptly.

n8n 3.0.0 beta is available now, with the stable 3.x release planned for early December 2026. npm and npx installs are no longer supported, and legacy nodes such as Function, Cron and Interval are removed. The default Code node timeout drops to 1 minute and unverified community packages are off by default. Support for 1.x ends on 31 December 2026, and upgrades are one-way, so n8n advises using the Migration Report (2.39+) and taking a full backup.

Why it matters: Anyone running client automations on self-hosted n8n needs a migration plan before December, especially npm-based installs.

SAP made a strategic investment in n8n and signed a multi-year partnership to embed n8n natively in Joule Studio, SAP's agent-building environment. The deal values n8n at $5.2B, up from $2.5B less than a year earlier. The investment amount was not disclosed. n8n reports more than 1,400 enterprise customers and 1.7 million monthly active builders.

Why it matters: n8n is moving further into enterprise work, which secures its future but may shift its priorities and pricing away from small self-hosters.