v0.99.8
October 23, 2026
Security update: Node.js 24.22.1 runtime in the images, removal of the compromised eMudhra certificate authorities and three updated libraries.
-
Security
Updated runtime in the images
FlowSharp images are rebuilt on Node.js 24.22.1, which closes the vulnerabilities published on October 21, 2026: among them a possible code execution through compressed responses received from external services and a bypass of the host name check in TLS certificates. To stay protected, just pull the images again: there are no migrations and no changes in daily use.
-
Security
Compromised certificate authorities
On October 20, 2026 eight eMudhra intermediate certificate authorities were found compromised. With this update FlowSharp no longer trusts their certificates when calling webhooks, connectors, email and AI providers. Whoever runs an installation should also update the operating system certificate bundle and n8n, if present.
-
Security
Updated libraries
Three libraries with security advisories were updated: the sanitizer of the HTML shown in the interface (dompurify), the API server (fastify) and IP address parsing (ip-address). No visible effect.