BREAKING DOWN CVE-2026-25049: HOW TYPESCRIPT TYPES FAILED N8N'S SECURITY

Summary from the TLDR InfoSec newsletter

CVE-2026-25049 (CVSS 9.4) exploits a type confusion flaw in n8n's expression evaluator, bypassing a prior security patch by sending object inputs instead of strings — since TypeScript types are stripped at compile-time, the runtime sanitizer never executed. Attackers use JavaScript destructuring to access the Function constructor and achieve unauthenticated RCE via public webhook endpoints, exposing stored credentials, API keys, and internal network access. Users should upgrade to n8n versions 1.123.17 or 2.5.2 and implement runtime type validation using typeof checks or a schema validation library such as Zod.