n8nPublished 28 Oct 2026NVD status: Deferred

CVE-2026-118646

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service vulnerability that allows authenticated members to block the event loop via crafted glob patterns.

Componentn8n
Severitymedium (CVSS 6.5)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published (NVD)2026-10-28
Affected versions
< 1.123.85
>= 2.0.0, < 2.43.5
>= 2.44.0, < 2.44.1
from the CVE Program record written by the CNA that assigned the CVE
Fixed in1.123.85, 2.43.5, 2.44.1
WeaknessCWE-1333
CISA KEVnot listed

Versions, checked against NVD

NVD's record (status: Deferred) lists no affected versions of n8n for this CVE. The ranges above come from the CVE record written by VulnCheck, the CNA that assigned the CVE.

NVD description

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service vulnerability that allows authenticated members to block the event loop via crafted glob patterns. Attackers who can create and run workflows can submit a wildcard-heavy File(s) Selector pattern causing exponential backtracking, making the UI, API, webhooks, and health checks unresponsive until restart.

What to do

  • Upgrade n8n to the fixed release of the branch you run: 1.123.85, 2.43.5 or 2.44.1, or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources

Read more