Node-RED is a low-code tool for event-driven programs. In a browser editor you drag nodes onto a canvas, such as an MQTT input, an HTTP endpoint, a function or a database write, and wire them into flows; deploying turns them into a running Node.js application. Messages travel along the wires as JavaScript objects, and when no node does what you need, a function node takes a few lines of JavaScript.
It is an OpenJS Foundation project, runs as happily on a Raspberry Pi as on a server, and is a staple of home automation and industrial IoT. The community library at flows.nodered.org adds thousands of extra nodes and shared flows. It is Apache-2.0, with 298 contributors and about 23,800 stars, at 5.0.9 when scanned.
The limit to know is security, not features: out of the box the editor has no login, and a deployed flow can run any code with the rights of the user running Node-RED. Turn on the editor's authentication before anyone else can reach it.
- Repository: github.com/node-red/node-red
- Licence: Apache-2.0 (Apache License 2.0)
- Language: JavaScript. Stars: 23.8K. Forks: 3,943. Last push: Oct 26, 2026.
- Scan: safe, Oct 26, 2026, commit 22d019c
Who it is for
Makers and home-automation fans connecting sensors and smart devices, engineers prototyping integrations between APIs, and teams who want automations that non-programmers can read.
Getting started
1. Install globally with npm (needs Node.js)
sudo npm install -g --unsafe-perm node-red2. Start it, then open http://localhost:1880
node-redThe README's install uses sudo with --unsafe-perm so npm can build native add-ons as root. The getting-started guide on nodered.org also covers Docker, Raspberry Pi and other platforms. Before exposing the editor to a network, set adminAuth in settings.js in your Node-RED user folder.
Safety scan
We cloned node-red/node-red at commit 22d019c on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no suspicious code patterns, no committed binaries and no bare-IP URLs across about 63,000 lines of JavaScript.
- The one installer-style script, scripts/install-ui-test-dependencies.sh (11 lines), sets up the editor's UI test suite, with no sudo and no downloads. There are no npm install hooks in the package.
- 17 known advisories in package-lock.json (1 critical, 5 high), and some are in runtime dependencies: body-parser and multer (request handling, denial-of-service class), DOMPurify in the editor (the critical one applies to its SAFE_FOR_TEMPLATES mode), undici and serialize-javascript. Fixes arrive through Node-RED's own releases, so keep it updated.
- 2 workflows, none using pull_request_target; neither of the 2 third-party actions is pinned to a commit. Security policy, Dependabot, contributing guide and code of conduct all present. OpenSSF Scorecard 6.5 of 10, among the better scores on this list.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 1 installer script |
| Committed binaries | None. |
| CI workflows | 2 workflows. None use pull_request_target. 2 of 2 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 18 distinct hosts referenced from source; most often js.foundation, www.apache.org, sub.example, a.b.example. No URLs to bare IP addresses. |
| Known vulnerabilities | 17 advisories across 942 pinned packages: 1 critical, 5 high, 4 moderate, 7 low. package-lock.json: 1,063 packages, 17 advisories. |
| Project hygiene | Has security policy, automated dependency updates, licence file, contributing guide. Missing CodeQL. |
| OpenSSF Scorecard | 6.5 out of 10, as of Oct 19, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Installer scripts (1)
- scripts/install-ui-test-dependencies.sh, 11 lines
Worst known vulnerabilities (17 of 17)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-cg2g-xh64-v4q7 | critical | dompurify@3.4.14 | DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output mo… |
| GHSA-27r3-jxmh-p828 | high | body-parser@1.20.8 | body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body |
| GHSA-mrv2-3pqr-j5jr | high | dompurify@3.4.14 | DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete… |
| GHSA-q7qp-rjg7-q26m | high | multer@2.4.0 | multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown |
| GHSA-xjj6-f33q-929c | high | undici@6.29.0 | undici vulnerable to Denial of Service via unhandled error on excessive content-encodings |
| GHSA-5c6j-r48x-rmvq | high | serialize-javascript@6.0.2 | Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString() |
| GHSA-q89c-q3h5-w34g | moderate | i18next-http-backend@1.4.1 | i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns |
| GHSA-rxp7-6hxx-x8q5 | moderate | ip-address@10.7.2 | ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long strin… |
| GHSA-4qv8-2p9j-2685 | moderate | undici@6.29.0 | undici vulnerable to Denial of Service via unbounded memory in the EventSource parser |
| GHSA-qj8w-gfj5-8c6v | moderate | serialize-javascript@6.0.2 | Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects |
| GHSA-73rr-hh4g-fpgx | low | diff@7.0.0 | jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch |
| GHSA-6688-9rhm-gjv2 | low | dompurify@3.4.14 | DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup - pure HTML reparse executes |
| GHSA-c6gr-qvv4-5v3f | low | dompurify@3.4.14 | DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml |
| GHSA-p98j-92pf-mc4p | low | dompurify@3.4.14 | DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS |
| GHSA-xvq9-wjp8-hwqf | low | i18next-http-backend@1.4.1 | i18next-http-backend incomplete URL validation permits SSRF |
| GHSA-238p-pmpm-9mq7 | low | katex@0.16.47 | KaTeX: Existing prototype pollution can bypass trust restrictions |
| GHSA-m5mm-p8h7-m29v | low | serialize-javascript@6.0.2 | Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body |
By the numbers
| Stars | 23.8K |
|---|---|
| Forks | 3,943 |
| Contributors | 298 |
| Commits | 10.9K |
| Open issues | 219 |
| Open pull requests | 125 |
| Releases | 189 |
| Latest release | 5.0.9 |
| Licence | Apache-2.0 |
| Main language | JavaScript |
| Project age | 13 years |
| Last push | Oct 26, 2026 |
| Tracked files | 1,550 |
| Lines of code | 64.8K |
| Checkout size | 36 MB |
Lines by language: JavaScript 62.6K, Markdown 1,235, JSON 633, HTML 197, YAML 187, Shell 11.
Questions
Is Node-RED free?
Yes. Node-RED is free and open source under Apache-2.0 and is a project of the OpenJS Foundation. The nodes and flows in the community library are free to install, each under its author's licence.
Do I need to know how to code to use Node-RED?
Not for many flows: you connect ready-made nodes and set their options in forms. Knowing a little JavaScript helps, because the function node lets you transform messages with your own code when no node fits.
How do I secure the Node-RED editor?
Set adminAuth in settings.js with a username and a bcrypt-hashed password, and serve the editor over HTTPS if it is reachable from other machines. Without that, anyone who can reach port 1880 can change and deploy flows. The Securing Node-RED page in the official docs walks through it.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.