Securaity Browse advisories
SA-26-621 High

n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node…

n8n

More for n8n RSS feed for n8n

Severity
High, CVSS 7.1
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Record
CVE-2026-86081
Affects
n8n
Known exploited
Not listed in the CISA Known Exploited Vulnerabilities catalog
Published
Record first published by the source
September 10, 2026
Source last modified
September 10, 2026

Description

Impact

The Git node's clone operation matched the destination path against the default N8N_BLOCK_FILE_PATTERNS expression, which was written so that a crafted path caused catastrophic backtracking. Evaluation runs synchronously in the main n8n process, so an authenticated user could freeze the instance for everyone with a single workflow execution and no unusual configuration. The patch rewrites the pattern so that matching is linear in the length of the path.

Patches

The issue has been fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict n8n instance access to fully trusted users only. - Disable the Git node by adding n8n-nodes-base.git to the NODES_EXCLUDE environment variable. - Set N8N_BLOCK_FILE_PATTERNS to a backtracking-safe equivalent pattern to replace the vulnerable default.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Description quoted from the NVD record.

Who is affected

n8n is a tool for connecting apps and automating routine tasks through workflows. This flaw is in the Git building block, the part that copies (clones) a code project from Git. In versions of n8n that do not include the fix, anyone with a login to your n8n could freeze the whole system for everyone by running a single workflow, with no unusual setup needed. The fix is in versions 1.123.76, 2.37.7 and 2.38.2. This flaw is rated High.

What to do

  1. The person who installed or runs n8n for your organization should upgrade it to version 1.123.76, 2.37.7 or 2.38.2, or later.
  2. If an IT provider or vendor runs n8n for you, send them this advisory and ask when the update will be done.
  3. If you cannot upgrade right away, limit access to your n8n to fully trusted users only.
  4. As another short-term measure, turn off the Git building block by adding n8n-nodes-base.git to the NODES_EXCLUDE setting, or replace the default N8N_BLOCK_FILE_PATTERNS setting with a safe equivalent pattern. These steps reduce the risk but do not fully remove it.

Analysis written from the source record as of September 10, 2026 and reviewed before publishing.

Sources

MORE ADVISORIES

See all