Phantom dispatches - old messages automatically resent without API logs

[thinunesmedeiros-cmyk]

Welcome!

• Yes, I have searched for similar issues on GitHub and found none.

What did you do?

Bug Report: Phantom Message Dispatches

Environment:

• Evolution API v2.3.7 (Docker)
• 27 active WhatsApp instances
• Integrated with n8n workflow automation
• Normal flow: Telegram → n8n → Evolution API → WhatsApp groups

Problem:
Evolution API automatically resends old promotional messages to WhatsApp groups without:

• Any execution logs in Evolution API (zero sendMessage/sendMedia entries)
• Any workflow execution in n8n
• Any trigger from our automation system

Observed Behavior:

• Old messages randomly resent to multiple groups
• Occurs at random times (morning, afternoon, night)
• Affects different instances randomly
• Affects different groups randomly
• Messages show source: 'web' in internal logs
• Original formatting/affiliate tags preserved

Investigation Performed:
✅ No security breach (server secure)
✅ No duplicate Evolution processes
✅ No malicious scripts/crons
✅ Found 2 orphan instances (removed, but problem persists)
✅ Problem affects legitimate instances too

Example Log:

{
  messageType: 'imageMessage',
  messageTimestamp: 1770916907,
  instanceId: '9da7e9d7-a7fd-427f-92cd-2e2e35764505',
  source: 'web'
}

Expected: Only messages sent through API should be dispatched
Actual: Old cached messages randomly resent without API calls

Impact: Uncontrolled promotional content sent to customers

What did you expect?

Only messages explicitly sent through Evolution API calls should be dispatched to WhatsApp groups. All message sending should generate proper API logs (sendMessage/sendMedia entries). No automatic resending of old/cached messages should occur.

What did you observe instead of what you expected?

Old promotional messages are automatically resent to WhatsApp groups without any API calls being made. These phantom dispatches:

• Generate zero API logs (no sendMessage/sendMedia entries)
• Show source: 'web' in internal logs instead of API source
• Occur at random times with random instances and groups
• Resend messages that were sent days/weeks ago
• Bypass all normal workflow automation (n8n)
• Maintain original formatting and affiliate tags

Example: Air conditioner promotion from weeks ago suddenly resent to multiple groups at 14:22 without any trigger from our automation system.

Screenshots/Videos

Which version of the API are you using?

v2.3.7

What is your environment?

Windows

Other environment specifications

• Ubuntu Server (VPS)
• Docker containers
• Evolution API v2.3.7 in Docker
• 27+ active WhatsApp instances
• Integrated with n8n workflow automation
• Redis and PostgreSQL containers

If applicable, paste the log output

{
key: {
remoteJid: '120363407365480409@g.us',
fromMe: false,
id: '3EB01B31CCB9F5F8FC3353',
participant: '92686098907215@lid',
participantAlt: '558195568013@s.whatsapp.net'
},
pushName: 'adm',
status: 'DELIVERY_ACK',
message: {
imageMessage: {
caption: 'SUA CASA AINDA MAIS CONFORTÁVEL\n\nAr-condicionado Electrolux Split Inverter 9.000 BTUs Color Adapt Wi-Fi Só Frio\n\n💵POR 1.648,90\n📌CUPOM: OFERTADEHOJE\n\nhttps://mercadolivre.com/sec/2j8t1pK'
}
},
messageType: 'imageMessage',
messageTimestamp: 1770916907,
instanceId: '9da7e9d7-a7fd-427f-92cd-2e2e35764505',
source: 'web'
}

Additional Notes

• Issue persists after removing orphaned instances with empty directories
• All 23 physical instance directories show 0 files, yet 27 instances work normally
• Problem affects legitimate instances that appear in web interface
• No correlation found with specific groups, instances, or timing patterns
• Investigation confirmed no security breaches or external interference
• Cache/internal data structure may be corrupted causing message replay
• Business impact: Uncontrolled promotional content sent to customers