Regular Expression Denial of Service in n8n by n8n-io

CVE-2026-77082

What is CVE-2026-77082?

n8n, a popular workflow automation tool, is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability affecting specific versions. This flaw arises in the Filter and Switch nodes, where user-supplied regular expressions are compiled using new RegExp() and executed synchronously on the worker thread. The absence of complexity validation or execution timeout means that a maliciously crafted regex pattern can monopolize the worker's resources for an extended duration, causing delays in workflow executions on the same worker. It is crucial for users to review the affected versions and consider implementing mitigations to enhance security against potential exploitation.

References