Prototype pollution in n8n - CVE-2026-110848
Published: September 30, 2026 / Updated: October 16, 2026
Vulnerability identifier: #VU153007
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-110848
CWE-ID: CWE-1321
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper control of object prototype attributes in the AI workflow builder's connect-nodes operation when merging workflow connections containing API-submitted node names. A remote user can submit a workflow with a reserved JavaScript property name to cause a denial of service.
The API accepts node names that the editor refuses, and the resulting global object prototype change persists until the instance restarts.
Affected software
n8n
How to mitigate CVE-2026-110848
Install security update from vendor's website.
n8n - addressed in versions 1.123.83, 2.41.4, 2.42.1