Skip to content
AI Sec Watch
HighVulnerability

GHSA-xwx6-jjhv-84p8: n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service

Source
GitHub Advisory(opens in a new tab)
Identifier
GHSA-xwx6-jjhv-84p8
Published
Record updated
View JSON
Affected
  • n8n >= 2.0.0-rc.0, < 2.31.5, fixed in 2.31.5, released July 22, 2026, on the day of disclosure
  • n8n >= 2.32.0, < 2.32.1, fixed in 2.32.1, released July 22, 2026, on the day of disclosure
  • n8n < 1.123.67, fixed in 1.123.67, released July 22, 2026, on the day of disclosure

Summary

An authenticated user could name a field in the Edit Fields (Set) node after an inherited built-in method path, because the dot-notation path setter did not restrict field names. This corrupted a shared global in the main Node.js process that the request-authentication path relied on, so the n8n instance failed every authenticated request until the process was restarted.

Mitigation

Fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1; users should upgrade to one of these or later. If upgrading is not immediately possible, restrict instance access to fully trusted users, disable or restrict workflow creation and execution for untrusted users, and monitor for unexpected process-wide HTTP 500 errors, restarting the process promptly if they occur. The source states these workarounds do not fully remediate the risk and are short-term measures only.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

  • n8nnpmLLM dependency since 2026-02-10

Related items