Regular Expression Denial of Service in n8n Workflow Automation Tool
CVE-2026-118646

7.1HIGH

Key Information:

Vendor

N8n-io

Status
N8n
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118646?

The n8n workflow automation tool has a vulnerability that allows authenticated users to exploit crafted glob patterns. By using overly complex wildcard expressions in File(s) Selector workflows, an attacker can trigger exponential backtracking in regular expressions, causing the event loop to hang. This leads to a scenario where the UI, API, webhooks, and health checks become unresponsive until the service is restarted, potentially disrupting normal operations and user activities.

Affected Version(s)

n8n 0 < 1.123.85

n8n 2.44.0 < 2.44.1

n8n 2.0.0 < 2.43.5

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-m7...
vendor-advisory
https://www.vulncheck.com/advisories/n8n-before-1.123.85-...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Masofgon
.