Prototype pollution in n8n - CVE-2026-118678
Published: November 9, 2026 / Updated: November 10, 2026
Vulnerability identifier: #VU163084
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-118678
CWE-ID: CWE-1321
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged remote attacker to cause denial of service in n8n with workflow history enabled, making logins and writes fail with server errors.
The vulnerability exists due to prototype pollution in workflow-history compaction when the connections-diff routine uses attacker-controlled connection keys directly as object members. A low-privileged remote attacker can save a workflow with a specially named connection key and trigger process-wide disruption when periodic compaction processes it.
Affected software
n8n
How to mitigate CVE-2026-118678
Install security update from vendor's website.
n8n - update to 2.41.4