n8n: Denial of Service via ZIP decompression in webhook workflow
n8n
- Severity
- High, CVSS 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Record
- CVE-2026-54314
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 23, 2026
- Source last modified
- October 26, 2026
Description
n8n is an open source workflow automation platform. Prior to 2.24.0, the Compression node's Decompress operation expanded attacker-controlled archives into memory without enforcing limits on decompressed output size. An unauthenticated attacker could send a small compressed archive to a public webhook workflow using this node, causing the n8n process to terminate due to memory exhaustion and disrupting all workflows in the same instance. This vulnerability is fixed in 2.24.0.
Description quoted from the NVD record.
Who is affected
n8n is a tool for connecting apps and automating routine tasks through workflows. This flaw affects versions before 2.24.0, in setups where a workflow can be started by anyone over the internet (a public webhook) and uses the building block that unpacks compressed files such as ZIP files. An attacker who does not need to log in could send a small compressed file that expands to a huge size, so n8n runs out of memory and shuts down. That stops every workflow running in the same n8n installation. This flaw is rated High.
What to do
- Find out who runs n8n for your organization: the person or team who installed it, or an IT provider or vendor who manages it for you.
- If your own staff run n8n, have them update it to version
2.24.0or later, which fixes this flaw. Do this soon if any workflow can be started from the internet and unpacks compressed files. - If an IT provider or vendor runs n8n for you, send them this advisory and ask when the update to version
2.24.0will be done.
Analysis written from the source record as of October 26, 2026 and reviewed before publishing.