CVE-2026-118646 in n8n
Summary
by MITRE • 10/28/2026
n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service vulnerability that allows authenticated members to block the event loop via crafted glob patterns. Attackers who can create and run workflows can submit a wildcard-heavy File(s) Selector pattern causing exponential backtracking, making the UI, API, webhooks, and health checks unresponsive until restart.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in n8n versions prior to 1.123.85, 2.43.5, and 2.44.1 represents a significant regular expression denial of service flaw that compromises the availability of the automation platform. This issue specifically affects authenticated users who possess the ability to create and execute workflows within the system. The core technical defect lies in how the application processes glob patterns used by the File(s) Selector node, which is designed to match file paths against user-defined wildcard criteria. When an attacker submits a crafted pattern containing specific combinations of wildcards such as asterisks and question marks alongside literal characters, it triggers catastrophic backtracking within the underlying regular expression engine. This phenomenon occurs because the regex algorithm attempts numerous permutations to find a match or determine non-matching status, leading to exponential time complexity relative to the input length rather than linear processing.
From an operational perspective, this vulnerability has severe consequences for system stability and service continuity. Because n8n typically runs on a single-threaded event loop architecture common in Node.js environments, any operation that blocks this loop prevents all other concurrent tasks from executing. Consequently, when a malicious glob pattern is processed by the File(s) Selector node during workflow execution, it monopolizes the CPU resources indefinitely or for an extended duration until the process times out or crashes. This results in the complete unresponsiveness of critical components including the user interface, application programming interfaces, webhook listeners, and health check endpoints. The only effective remediation at runtime is to restart the n8n instance, which disrupts ongoing automation tasks and requires manual intervention by system administrators to restore service availability.
This vulnerability aligns with Common Weakness Enumeration category CWE-400, which describes uncontrolled resource consumption leading to denial of service conditions. Furthermore, it maps directly to MITRE ATT&CK technique T1496, specifically the sub-category Resource Hijacking or Denial of Service via computational exhaustion. The attack vector requires authentication, classifying this as an insider threat scenario where a compromised account or malicious internal actor can degrade system performance without needing external network access privileges beyond standard user permissions. This highlights the importance of implementing strict input validation and sanitization for any pattern-matching functionality that interacts with untrusted data sources within automation workflows.
To mitigate this risk, organizations running affected versions must upgrade to n8n version 1.123.85 or later, where the regular expression logic has been patched to prevent catastrophic backtracking through optimized matching algorithms or bounded iteration limits. In environments where immediate patching is not feasible, administrators should implement network-level controls such as rate limiting on API endpoints and workflow execution triggers to restrict the frequency of file selector operations. Additionally, deploying a Web Application Firewall with rules capable of detecting anomalous regex patterns can provide an additional layer of defense by blocking requests that exhibit characteristics of exponential backtracking attempts before they reach the application logic. Regular auditing of user permissions is also recommended to ensure that only trusted individuals have the ability to create and run workflows involving file system interactions, thereby reducing the attack surface for this specific exploitation vector.