GHSA-xwx6-jjhv-84p8: n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service
Summary
A vulnerability in n8n's Edit Fields (Set) node allowed authenticated users to create fields with names matching inherited methods, which corrupted shared global data in the Node.js process (prototype pollution, a technique where an attacker modifies object prototypes to affect all instances). This broke the authentication system and caused the entire n8n instance to reject all authenticated requests until restarted, affecting all users.
Solution / Mitigation
The issue has been fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should restrict n8n instance access to fully trusted users only, disable or restrict workflow creation and execution permissions for untrusted users, and monitor for unexpected process-wide HTTP 500 errors and restart the process promptly if they occur. However, these workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Classification
Affected Vendors
Affected Packages
Related Issues
CVE-2026-47482: NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause missing release of memory
CVE-2022-29200: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implem
Original source: https://github.com/advisories/GHSA-xwx6-jjhv-84p8
First tracked: July 22, 2026 at 08:01 PM
Classified by LLM (prompt v3) · confidence: 85%