Decaf Blog In-depth updates on Decaf software, tooling, and open-source experiments

n8n 1.123.56 - Hono and vue-i18n Security Dependency Updates

4 min read

n8n 1.123.56 is a patch release for the workflow automation platform, published June 15, 2026. The only functional change in the GitHub notes is a dependency security update that closes five medium severity issues across hono and vue-i18n via PR #31882.

n8n [email protected] shipped on June 15, 2026 as a stable release, not a prerelease. For teams running n8n as an ELT orchestrator or webhook driven integration layer, the meaningful work in this tag is entirely in transitive dependency pins. No new nodes, execution engine changes, or connector updates appear in the release notes.

The full release notes and downloads are on the GitHub release page.

Hono arrives through the MCP SDK chain

The hono bumps in commit bb369bc move the library from 4.12.18 to 4.12.21. n8n does not import hono directly. The path runs through @modelcontextprotocol/sdk, which pulls @hono/node-server, which in turn depends on hono.

That matters for platform operators who treat n8n as infrastructure. A vulnerability in a leaf HTTP framework still lands in your SBOM and scanner output even when application code never calls hono middleware. The PR #31882 analysis notes that n8n uses its own JwtService rather than hono JWT middleware, and handles cookies through cookie-parser and Express rather than hono cookie helpers. The exposure is supply chain and transitive runtime surface, not a direct API call from workflow code.

Hono 4.12.21 tightens Bearer scheme validation in JWT middleware, rejects injection characters in sameSite and priority cookie options, normalizes IPv6 comparisons in IP restriction middleware, and fixes path handling in app.mount() where percent encoded multi byte prefixes could route requests to the wrong mounted sub application. Those fixes address authentication bypass, access control bypass, cookie header injection, and path traversal classes in the hono tree.

vue-i18n and editor XSS surface

The vue-i18n side of the update targets a sanitization bypass in @intlify/shared. Entity encoded javascript: URLs and obfuscated schemes in HTML attributes or CSS can slip past defenses when templates use v-html with escapeParameterHtml enabled. That is an XSS class issue in the internationalization stack that backs the n8n editor UI.

For data engineering teams, the operational angle is credential and webhook context exposure through a compromised browser session on the n8n admin console. Workflow definitions often hold API keys, database connection strings, and OAuth tokens in node parameters. A client side script flaw in the editor layer is not the same as a remote code execution bug in the worker, but it can still leak secrets from an authenticated session.

The PR notes that breaking change analysis was incomplete for vue-i18n while hono breaking changes were judged non impacting for this codebase. Plan a quick smoke test of localized UI strings and any custom frontend extensions after upgrade, even though the release notes classify this as a bug fix only.

What this release does not change

The 1.123.56 compare view against [email protected] contains a single bug fix entry. There are no execution queue changes, no database migration steps, and no new environment variables documented in the release text.

If your deployment pipeline keys off semver feature bumps, treat 1.123.56 as a security maintenance tag. The value is scanner clearance and reduced transitive risk, not new integration capability. Teams already on 1.123.55 with an automated patch window should prioritize this over waiting for a larger feature release.

Upgrade notes for production operators

Pull the image or package for [email protected] through your normal change control path. Because the diff is dependency only, rollback is straightforward if you retain the previous container tag or npm lock snapshot.

Verify MCP related features if you enabled Model Context Protocol integrations. hono sits under that SDK path, so any MCP server or client workflows deserve a post upgrade connectivity check even though n8n does not expose hono middleware directly.

Re run your software composition analysis after deploy. Five resolved medium severity findings should drop from reports that track hono and vue-i18n versions. Document the upgrade in your change log with a link to the GitHub release page and PR #31882 for audit trails.

Where to get it