n8n-io/n8n · error · DisallowedModuleError

Module '${moduleName}' is disallowed

Error message

Module '${moduleName}' is disallowed

What it means

Thrown by the require resolver in the JS Task Runner when user code calls require() for a module that is not in the allowed built-in or external module allowlist. The resolver intercepts all require() calls in the sandboxed execution context, checks isBuiltin() to classify the request, then checks it against either allowedBuiltInModules or allowedExternalModules before allowing the actual require() to proceed.

Source

Thrown at packages/@n8n/task-runner/src/js-task-runner/require-resolver.ts:129

}

export function createRequireResolver({
	allowedBuiltInModules,
	allowedExternalModules,
	secureModules = false,
}: RequireResolverOpts) {
	return (request: string) => {
		const checkIsAllowed = (allowList: Set<string> | '*', moduleName: string) => {
			return allowList === '*' || allowList.has(moduleName);
		};

		const isAllowed = isBuiltin(request)
			? checkIsAllowed(allowedBuiltInModules, request)
			: checkIsAllowed(allowedExternalModules, request);

		if (!isAllowed) {
			const error = new DisallowedModuleError(request);
			throw new ExecutionError(error);
		}

		// eslint-disable-next-line @typescript-eslint/no-require-imports
		const resolved = require(request) as unknown;

		return secureModules ? secureModuleExport(resolved) : resolved;
	};
}

View on GitHub (pinned to 5ac6606e81)

Solutions

1. Add the module name to the appropriate environment variable: NODE_FUNCTION_ALLOW_BUILTIN for built-in modules, NODE_FUNCTION_ALLOW_EXTERNAL for external packages.
2. If the functionality is available through a different allowed module or helper, refactor to use that instead.
3. For built-in modules, check the default allowlist — common ones like 'crypto' may already be allowed.
4. Contact the n8n administrator if you cannot change environment variables yourself.

Example fix

// before — user code
const fs = require('fs'); // throws if fs not in allowlist
// after — add to env config
// Set: NODE_FUNCTION_ALLOW_BUILTIN=fs,path,crypto
// Then: const fs = require('fs'); // now allowed

// Check if a module is allowed before requiring
const allowedBuiltIns = new Set((process.env.NODE_FUNCTION_ALLOW_BUILTIN ?? '').split(','));
const allowedExternals = new Set((process.env.NODE_FUNCTION_ALLOW_EXTERNAL ?? '').split(','));

function isModuleAllowed(moduleName: string): boolean {
  const { isBuiltin } = require('node:module');
  return isBuiltin(moduleName)
    ? allowedBuiltIns.has(moduleName)
    : allowedExternals.has(moduleName);
}

import { ExecutionError } from '@n8n/task-runner';

try {
  const mod = require('my-package');
} catch (e) {
  if (e instanceof ExecutionError && e.message.includes('disallowed')) {
    // inform user to add the module to the allowlist
    throw new UserError(
      `Module is not allowed. Add it to NODE_FUNCTION_ALLOW_EXTERNAL.`
    );
  }
  throw e;
}

When it happens

Trigger: User code in a Code Node (task-runner mode) calls require('fs'), require('crypto'), or any module not explicitly allowed. The resolver's checkIsAllowed returns false because the module name is absent from the configured Set, and DisallowedModuleError is wrapped in an ExecutionError and thrown.

Common situations: Code Node code attempts to use a Node.js built-in (fs, child_process, net) not on the built-in allowlist. Importing an external npm package that the administrator hasn't whitelisted via NODE_FUNCTION_ALLOW_BUILTIN or NODE_FUNCTION_ALLOW_EXTERNAL environment variables. Security policy tightening that removed previously allowed modules.

Related errors

• Security violation detected
• Wildcard '*' in {list_name} must be used alone, not with oth
• Security violations detected
• String pattern accessing '{attr}' is disallowed, because it
• Workspace has no sandbox

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/1ecf7f781d3ffcef. Report an issue: GitHub.