CVE-2026-77082 in n8n
Summary
by MITRE • 08/20/2026
n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service (ReDoS) vulnerability in the Filter and Switch nodes, which compile user-supplied regex patterns with new RegExp() and execute them synchronously on the worker thread without complexity validation or execution timeout. A crafted regex pattern can block the worker for an extended period per data item processed, delaying other workflow executions on the same worker.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified in n8n versions prior to 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 represents a significant security flaw rooted in the improper handling of regular expression patterns within the Filter and Switch nodes. This issue is classified as a Regular Expression Denial of Service, commonly referred to as ReDoS, which falls under the CWE-1333 category for inefficient regular expression complexity. The core technical failure lies in how these specific workflow components process user-defined logic. When a user configures a Filter or Switch node with a custom condition involving regex matching, n8n compiles this input directly into a JavaScript RegExp object using the new constructor and executes it synchronously on the main worker thread. Crucially, the system lacks any mechanism to validate the computational complexity of the provided pattern before execution nor does it implement an execution timeout or safeguard against catastrophic backtracking.
In standard web application security, regular expressions are often executed in isolated contexts or with strict timeouts to prevent malicious inputs from consuming excessive CPU resources. However, because n8n operates as a workflow automation platform where performance and concurrency are critical, the synchronous nature of this regex evaluation creates a severe bottleneck. A crafted regex pattern designed to trigger exponential time complexity can cause the worker thread to hang for an extended period while processing each data item. This behavior effectively monopolizes the single-threaded event loop or the specific worker process responsible for that workflow execution. The impact is not merely localized to the affected node but propagates through the entire workflow instance, causing significant delays in downstream operations and preventing other workflows from being processed on the same worker instance due to resource contention.
The operational impact of this vulnerability extends beyond simple latency. In a multi-tenant or high-throughput environment where n8n is deployed as a service, an attacker could exploit this flaw by submitting workflow configurations containing malicious regex patterns. This constitutes a denial-of-service attack against the automation infrastructure itself. By triggering these inefficient computations repeatedly across multiple data items within a single workflow run, an adversary can exhaust available worker threads or CPU cycles on the host system. This leads to degraded performance for all other users and services relying on that n8n instance, potentially causing complete unavailability of critical business processes until the affected workers are restarted or the malicious workflows are terminated manually by an administrator.
To mitigate this risk, organizations running vulnerable versions of n8n must upgrade immediately to version 1.123.69, 2.33.4, or later for the respective major branches, as these releases include patches that address the regex handling logic. For environments where immediate upgrading is not feasible, administrative controls should be implemented to restrict who can create workflows containing custom Filter and Switch nodes with complex regular expressions. Additionally, deploying a Web Application Firewall (WAF) capable of detecting anomalous traffic patterns or blocking known malicious payload signatures may provide an additional layer of defense against exploitation attempts. Security teams should also monitor system metrics for unusual spikes in CPU usage associated with n8n worker processes, which could indicate active exploitation of this ReDoS vulnerability.
From a threat intelligence perspective, this vulnerability aligns with the MITRE ATT&CK technique T1496, Resource Hijacking, specifically through computational exhaustion via inefficient algorithms. It also relates to CWE-730 in terms of improper control flow handling when dealing with untrusted input that triggers pathological algorithmic behavior. The lack of complexity validation is a common oversight in applications that dynamically compile code or patterns from user input without sandboxing or strict performance constraints. By addressing this flaw, n8n improves the resilience of its automation engine against both accidental misconfigurations by users and deliberate attacks aimed at disrupting service availability through resource exhaustion techniques.