n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match

Published September 10, 2026 CVE-2026-86081

An authenticated n8n user can freeze the entire n8n instance with one workflow run. This makes the service stop responding to everyone.

Severity
HighCVSS 4.0 · 7.1
Fix
Fixed in 1.123.76Fix recorded today
Affected versions
2.38.0 or newer, but before 2.38.2; 2.0.0 or newer, but before 2.37.7; before 1.123.76
Weakness
CWE-1333Inefficient Regular Expression Complexity (ReDoS)
Exploit likelihood
0.32% in 30 daysEPSS, higher than 25% of known flaws
Affects
n8n

How it works

  • An authenticated workflow editor runs a workflow using n8n's Git node clone operation. n8n compares the destination path against a built-in file-blocking rule.
  • A specially crafted path can make that check consume excessive processing time.
  • Because the check runs in n8n's main process, one workflow execution can freeze the instance.

What to do

Run npm list n8n in the n8n installation and compare the installed version with the affected ranges: below 1.123.76, 2.0.0 through 2.37.6, or 2.38.0 through 2.38.1.

Run this in the application environment you want to check:

npm list n8n

Upgrade n8n to version 1.123.76, 2.37.7, 2.38.2, or later. Until then, restrict access to trusted users, disable the Git node, or replace the default file-blocking pattern using the advisory's documented mitigation.

Technical details

CVE-2026-86081 affects n8n's Git node clone path check. A crafted path can force inefficient pattern matching that consumes excessive CPU time while synchronously blocking the main n8n process.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low No extra steps to bypass built-in attack protections
  • Required conditions None No particular deployment or execution condition is required
  • Privileges required Low Attacker needs a basic user account
  • User action None No action by another user is required
  • Vulnerable system: Data exposure None No data disclosure
  • Vulnerable system: Data changes None No data tampering
  • Vulnerable system: Service disruption High The service can stop or suffer serious disruption
  • Other systems: Data exposure None No additional impact beyond the vulnerable system
  • Other systems: Data changes None No additional impact beyond the vulnerable system
  • Other systems: Service disruption None No additional impact beyond the vulnerable system
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Open in FIRST.org calculator

References

View Original Source