CVE-2026-77082 n8n before 1.123.69 ReDoS via Filter and Switch Node

Medium 5.3 Published 20 Aug 2026 Updated 21 Aug 2026

Attackers can cause denial of service in n8n by submitting malicious regex patterns to Filter and Switch nodes, blocking worker threads.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-77082?

CVE-2026-77082 is a medium-severity denial of service vulnerability in N8n N8n, published on 20 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service (ReDoS) vulnerability in the Filter and Switch nodes, which compile user-supplied regex patterns with new RegExp() and execute them synchronously on the worker thread without complexity validation or execution timeout. A crafted regex pattern can block the worker for an extended period per data item processed, delaying other workflow executions on the same worker.

Weakness: CWE-1333

Which versions are affected by CVE-2026-77082?

It affects 1 product.

Products include N8n N8n.

How do I fix CVE-2026-77082?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-77082 being exploited?

There is no known exploitation of CVE-2026-77082 in the wild and no public exploit code.

All N8n N8n vulnerabilities

Sources

Also known as GHSA-jxf5-f3hg-vxvj, GHSA-q3fv-295f-qfpf, MINI-29qf-jc5f-f266.