{"record":{"id":"1ecf7f781d3ffcef","repo":"n8n-io/n8n","slug":"module-modulename-is-disallowed","errorCode":null,"errorMessage":"Module '${moduleName}' is disallowed","messagePattern":"Module '(.+?)' is disallowed","errorType":"exception","errorClass":"DisallowedModuleError","httpStatus":null,"severity":"error","filePath":"packages/@n8n/task-runner/src/js-task-runner/require-resolver.ts","lineNumber":129,"sourceCode":"}\n\nexport function createRequireResolver({\n\tallowedBuiltInModules,\n\tallowedExternalModules,\n\tsecureModules = false,\n}: RequireResolverOpts) {\n\treturn (request: string) => {\n\t\tconst checkIsAllowed = (allowList: Set<string> | '*', moduleName: string) => {\n\t\t\treturn allowList === '*' || allowList.has(moduleName);\n\t\t};\n\n\t\tconst isAllowed = isBuiltin(request)\n\t\t\t? checkIsAllowed(allowedBuiltInModules, request)\n\t\t\t: checkIsAllowed(allowedExternalModules, request);\n\n\t\tif (!isAllowed) {\n\t\t\tconst error = new DisallowedModuleError(request);\n\t\t\tthrow new ExecutionError(error);\n\t\t}\n\n\t\t// eslint-disable-next-line @typescript-eslint/no-require-imports\n\t\tconst resolved = require(request) as unknown;\n\n\t\treturn secureModules ? secureModuleExport(resolved) : resolved;\n\t};\n}\n","sourceCodeStart":111,"sourceCodeEnd":138,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/@n8n/task-runner/src/js-task-runner/require-resolver.ts#L111-L138","documentation":"Thrown by the require resolver in the JS Task Runner when user code calls require() for a module that is not in the allowed built-in or external module allowlist. The resolver intercepts all require() calls in the sandboxed execution context, checks isBuiltin() to classify the request, then checks it against either allowedBuiltInModules or allowedExternalModules before allowing the actual require() to proceed.","triggerScenarios":"User code in a Code Node (task-runner mode) calls require('fs'), require('crypto'), or any module not explicitly allowed. The resolver's checkIsAllowed returns false because the module name is absent from the configured Set, and DisallowedModuleError is wrapped in an ExecutionError and thrown.","commonSituations":"Code Node code attempts to use a Node.js built-in (fs, child_process, net) not on the built-in allowlist. Importing an external npm package that the administrator hasn't whitelisted via NODE_FUNCTION_ALLOW_BUILTIN or NODE_FUNCTION_ALLOW_EXTERNAL environment variables. Security policy tightening that removed previously allowed modules.","solutions":["Add the module name to the appropriate environment variable: NODE_FUNCTION_ALLOW_BUILTIN for built-in modules, NODE_FUNCTION_ALLOW_EXTERNAL for external packages.","If the functionality is available through a different allowed module or helper, refactor to use that instead.","For built-in modules, check the default allowlist — common ones like 'crypto' may already be allowed.","Contact the n8n administrator if you cannot change environment variables yourself."],"exampleFix":"// before — user code\nconst fs = require('fs'); // throws if fs not in allowlist\n// after — add to env config\n// Set: NODE_FUNCTION_ALLOW_BUILTIN=fs,path,crypto\n// Then: const fs = require('fs'); // now allowed","handlingStrategy":"validation","validationCode":"// Check if a module is allowed before requiring\nconst allowedBuiltIns = new Set((process.env.NODE_FUNCTION_ALLOW_BUILTIN ?? '').split(','));\nconst allowedExternals = new Set((process.env.NODE_FUNCTION_ALLOW_EXTERNAL ?? '').split(','));\n\nfunction isModuleAllowed(moduleName: string): boolean {\n  const { isBuiltin } = require('node:module');\n  return isBuiltin(moduleName)\n    ? allowedBuiltIns.has(moduleName)\n    : allowedExternals.has(moduleName);\n}","typeGuard":null,"tryCatchPattern":"import { ExecutionError } from '@n8n/task-runner';\n\ntry {\n  const mod = require('my-package');\n} catch (e) {\n  if (e instanceof ExecutionError && e.message.includes('disallowed')) {\n    // inform user to add the module to the allowlist\n    throw new UserError(\n      `Module is not allowed. Add it to NODE_FUNCTION_ALLOW_EXTERNAL.`\n    );\n  }\n  throw e;\n}","preventionTips":["Pre-register all modules your code needs in NODE_FUNCTION_ALLOW_BUILTIN / NODE_FUNCTION_ALLOW_EXTERNAL.","Avoid require() for built-in modules like fs or child_process in shared Code Nodes.","Document required modules in the workflow description for operators."],"tags":["task-runner","security","sandbox","module-resolution","configuration"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}