diff --git a/packages/node_modules/@node-red/editor-api/lib/auth/tokens.js b/packages/node_modules/@node-red/editor-api/lib/auth/tokens.js
index 6e867d7df..8cfd112d3 100644
--- a/packages/node_modules/@node-red/editor-api/lib/auth/tokens.js
+++ b/packages/node_modules/@node-red/editor-api/lib/auth/tokens.js
@@ -14,15 +14,7 @@
  * limitations under the License.
  **/
 
-function generateToken(length) {
-    var c = "ABCDEFGHIJKLMNOPQRSTUZWXYZabcdefghijklmnopqrstuvwxyz1234567890";
-    var token = [];
-    for (var i=0;i<length;i++) {
-        token.push(c[Math.floor(Math.random()*c.length)]);
-    }
-    return token.join("");
-}
-
+const crypto = require("crypto");
 
 var storage;
 var sessionExpiryTime
@@ -115,7 +107,7 @@ module.exports = {
     },
     create: function(user,client,scope) {
         return loadSessions().then(function() {
-            var accessToken = generateToken(128);
+            var accessToken = crypto.randomBytes(128).toString('base64');
 
             var accessTokenExpiresAt = Date.now() + (sessionExpiryTime*1000);
 
diff --git a/packages/node_modules/@node-red/editor-api/lib/editor/comms.js b/packages/node_modules/@node-red/editor-api/lib/editor/comms.js
index 84da62a69..386b5f8a8 100644
--- a/packages/node_modules/@node-red/editor-api/lib/editor/comms.js
+++ b/packages/node_modules/@node-red/editor-api/lib/editor/comms.js
@@ -16,6 +16,7 @@
 
 var ws = require("ws");
 var url = require("url");
+const crypto = require("crypto");
 
 var log = require("@node-red/util").log; // TODO: separate module
 var Tokens;
@@ -56,17 +57,9 @@ function handleSessionExpiry(session) {
         }
     })
 }
-function generateSession(length) {
-    var c = "ABCDEFGHIJKLMNOPQRSTUZWXYZabcdefghijklmnopqrstuvwxyz1234567890";
-    var token = [];
-    for (var i=0;i<length;i++) {
-        token.push(c[Math.floor(Math.random()*c.length)]);
-    }
-    return token.join("");
-}
 
 function CommsConnection(ws, user) {
-    this.session = generateSession(32);
+    this.session = crypto.randomBytes(32).toString('base64');
     this.ws = ws;
     this.stack = [];
     this.user = user;
diff --git a/packages/node_modules/@node-red/editor-client/src/js/ui/clipboard.js b/packages/node_modules/@node-red/editor-client/src/js/ui/clipboard.js
index 32ba905af..852f64058 100644
--- a/packages/node_modules/@node-red/editor-client/src/js/ui/clipboard.js
+++ b/packages/node_modules/@node-red/editor-client/src/js/ui/clipboard.js
@@ -722,6 +722,9 @@ RED.clipboard = (function() {
                             // representation or null
                             return null;
                         }
+                        if (value.type === 'undefined') {
+                            return undefined;
+                        }
                     }
                 }
                 return value;
diff --git a/packages/node_modules/@node-red/editor-client/src/js/ui/utils.js b/packages/node_modules/@node-red/editor-client/src/js/ui/utils.js
index e8306bd0f..6227fa683 100644
--- a/packages/node_modules/@node-red/editor-client/src/js/ui/utils.js
+++ b/packages/node_modules/@node-red/editor-client/src/js/ui/utils.js
@@ -52,7 +52,9 @@ RED.utils = (function() {
         } else if (value === null) {
             result = $('<span class="red-ui-debug-msg-object-value red-ui-debug-msg-type-null">null</span>');
         } else if (typeof value === 'object') {
-            if (value.hasOwnProperty('type') && value.type === 'Buffer' && value.hasOwnProperty('data')) {
+            if (value.hasOwnProperty('type') && value.type === 'undefined') {
+                result = $('<span class="red-ui-debug-msg-object-value red-ui-debug-msg-type-null">undefined</span>');
+            } else if (value.hasOwnProperty('type') && value.type === 'Buffer' && value.hasOwnProperty('data')) {
                 result = $('<span class="red-ui-debug-msg-object-value red-ui-debug-msg-type-meta"></span>').text('buffer['+value.length+']');
             } else if (value.hasOwnProperty('type') && value.type === 'array' && value.hasOwnProperty('data')) {
                 result = $('<span class="red-ui-debug-msg-object-value red-ui-debug-msg-type-meta"></span>').text('array['+value.length+']');
@@ -348,6 +350,8 @@ RED.utils = (function() {
         }
         if (obj === null || obj === undefined) {
             $('<span class="red-ui-debug-msg-type-null">'+obj+'</span>').appendTo(entryObj);
+        } else if (obj.__enc__ && obj.type === 'undefined') {
+            $('<span class="red-ui-debug-msg-type-null">undefined</span>').appendTo(entryObj);
         } else if (obj.__enc__ && obj.type === 'number') {
             e = $('<span class="red-ui-debug-msg-type-number red-ui-debug-msg-object-header"></span>').text(obj.data).appendTo(entryObj);
         } else if (typeHint === "function" || (obj.__enc__ && obj.type === 'function')) {
diff --git a/packages/node_modules/@node-red/runtime/lib/nodes/Node.js b/packages/node_modules/@node-red/runtime/lib/nodes/Node.js
index a93d7c52d..60b106426 100644
--- a/packages/node_modules/@node-red/runtime/lib/nodes/Node.js
+++ b/packages/node_modules/@node-red/runtime/lib/nodes/Node.js
@@ -215,7 +215,8 @@ Node.prototype._emitInput = function(arg) {
                 c++;
             }
             try {
-                node._inputCallbacks[i](
+                cb.call(
+                    node,
                     arg,
                     function() { node.send.apply(node,arguments) },
                     function(err) {
diff --git a/packages/node_modules/@node-red/runtime/lib/storage/localfilesystem/projects/git/authServer.js b/packages/node_modules/@node-red/runtime/lib/storage/localfilesystem/projects/git/authServer.js
index 95b4eda0c..d5a487273 100644
--- a/packages/node_modules/@node-red/runtime/lib/storage/localfilesystem/projects/git/authServer.js
+++ b/packages/node_modules/@node-red/runtime/lib/storage/localfilesystem/projects/git/authServer.js
@@ -18,9 +18,10 @@ var net = require("net");
 var fs = require("fs-extra");
 var path = require("path");
 var os = require("os");
+const crypto = require("crypto");
 
 function getListenPath() {
-    var seed = (0x100000+Math.random()*0x999999).toString(16);
+    var seed = crypto.randomBytes(8).toString('hex');
     var fn = 'node-red-git-askpass-'+seed+'-sock';
     var listenPath;
     if (process.platform === 'win32') {
diff --git a/packages/node_modules/@node-red/util/lib/util.js b/packages/node_modules/@node-red/util/lib/util.js
index f69ca890a..1141661de 100644
--- a/packages/node_modules/@node-red/util/lib/util.js
+++ b/packages/node_modules/@node-red/util/lib/util.js
@@ -771,6 +771,11 @@ function encodeObject(msg,opts) {
                             } else if (value.constructor.name === "Socket") {
                                 value = "[internal]"
                             }
+                        } else if (value === undefined) {
+                            value = {
+                                __enc__: true,
+                                type: "undefined",
+                            }
                         }
                         return value;
                     }," ");
diff --git a/test/unit/@node-red/runtime/lib/nodes/Node_spec.js b/test/unit/@node-red/runtime/lib/nodes/Node_spec.js
index 1f9ca04ce..61b4446f7 100644
--- a/test/unit/@node-red/runtime/lib/nodes/Node_spec.js
+++ b/test/unit/@node-red/runtime/lib/nodes/Node_spec.js
@@ -216,6 +216,7 @@ describe('Node', function() {
             n2.on('input',function(msg) {
                 // msg equals message, and is not a new copy
                 messageReceived = true;
+                should.strictEqual(this,n2);
                 should.deepEqual(msg,message);
                 should.strictEqual(msg,message);
                 done();
@@ -224,6 +225,34 @@ describe('Node', function() {
             messageReceived.should.be.false();
         });
 
+        it('emits a single message - multiple input event listeners', function(done) {
+            var flow = {
+                getNode: (id) => { return {'n1':n1,'n2':n2}[id]},
+            };
+            var n1 = new RedNode({_flow:flow,id:'n1',type:'abc',wires:[['n2']]});
+            var n2 = new RedNode({_flow:flow,id:'n2',type:'abc'});
+            var message = {payload:"hello world"};
+            var messageReceived = 0;
+            n2.on('input',function(msg) {
+                // msg equals message, and is not a new copy
+                messageReceived++;
+                messageReceived.should.be.exactly(1);
+                should.strictEqual(this,n2);
+                should.deepEqual(msg,message);
+                should.strictEqual(msg,message);
+            });
+            n2.on('input',function(msg) {
+                messageReceived++;
+                messageReceived.should.be.exactly(2);
+                should.strictEqual(this,n2);
+                should.deepEqual(msg,message);
+                should.strictEqual(msg,message);
+                done();
+            });
+            n1.send(message);
+            messageReceived.should.be.exactly(0);
+        });
+
         it('emits a single message - synchronous mode', function(done) {
             var flow = {
                 getNode: (id) => { return {'n1':n1,'n2':n2}[id]},
diff --git a/test/unit/@node-red/util/lib/util_spec.js b/test/unit/@node-red/util/lib/util_spec.js
index aa46bc0e1..c4a64d53f 100644
--- a/test/unit/@node-red/util/lib/util_spec.js
+++ b/test/unit/@node-red/util/lib/util_spec.js
@@ -740,6 +740,19 @@ describe("@node-red/util/util", function() {
                 resultJson.name.should.eql('my error obj');
                 resultJson.message.should.eql('my error message');
             });
+
+            it('object with undefined property', function() {
+                var msg = { msg:{a:1,b:undefined,c:3 } };
+                var result = util.encodeObject(msg);
+                result.format.should.eql("Object");
+                var resultJson = JSON.parse(result.msg);
+                resultJson.should.have.property("a",1);
+                resultJson.should.have.property("c",3);
+                resultJson.should.have.property("b");
+                resultJson.b.should.have.property("__enc__", true);
+                resultJson.b.should.have.property("type", "undefined");
+            });
+
             it('constructor of IncomingMessage', function() {
                 function IncomingMessage(){};
                 var msg = { msg:new IncomingMessage() };
@@ -791,6 +804,16 @@ describe("@node-red/util/util", function() {
                 resultJson[0].should.eql('abc...');
                 resultJson[1].should.eql('123...');
             });
+            it('array containing undefined', function() {
+                var msg = { msg:[1,undefined,3]};
+                var result = util.encodeObject(msg);
+                result.format.should.eql("array[3]");
+                var resultJson = JSON.parse(result.msg);
+                resultJson[0].should.eql(1);
+                resultJson[2].should.eql(3);
+                resultJson[1].__enc__.should.be.true();
+                resultJson[1].type.should.eql("undefined");
+            });
             it('array of function', function() {
                 var msg = { msg:[function(){}] };
                 var result = util.encodeObject(msg);