Inefficient regular expression complexity in n8n - CVE-2026-118646
Published: October 14, 2026 / Updated: November 2, 2026
Vulnerability identifier: #VU155727
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-118646
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to excessive regular expression backtracking in the Read/Write Files from Disk node when evaluating file selector glob patterns on the main event loop without a time limit. A remote user can submit a selector containing many wildcards to cause a denial of service.
Exploitation requires permission to create and run workflows. The UI, API, webhooks and health checks stop responding until the process is restarted.
Affected software
n8n
How to mitigate CVE-2026-118646
Install security update from vendor's website.
n8n - addressed in versions 1.123.85, 2.43.5, 2.44.1