Resource exhaustion in n8n - #VU141001
Published: August 5, 2026
Vulnerability identifier: #VU141001
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in Filter and Switch nodes when processing user-supplied regex patterns. A remote user can configure a specially crafted regex pattern to cause a denial of service.
The affected regex is compiled with new RegExp() and executed synchronously on the worker thread, which can delay other executions on the same worker while the regex runs.
Affected software
n8n
Remediation
Install security update from vendor's website.
n8n - addressed in versions 1.123.69, 2.33.4, 2.34.1