AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-j535-v25q-vx3q: n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path

highvulnerability

security

Source: GitHub Advisory DatabaseSeptember 10, 2026CVE-2026-86081

Summary

n8n, a workflow automation tool, has a vulnerability in its Git node where a specially crafted file path can cause ReDoS (regular expression denial of service, where a malicious input makes pattern matching take extremely long) in the default file-blocking pattern. An authenticated user could freeze the entire n8n instance for all users by running a workflow with this malicious path, since the pattern matching happens synchronously (blocking other tasks) in the main process.

Solution / Mitigation

The issue has been fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2. Users should upgrade to one of these versions or later. If immediate upgrade is not possible, temporary workarounds include: (1) restrict instance access to fully trusted users only, (2) disable the Git node by adding `n8n-nodes-base.git` to the `NODES_EXCLUDE` environment variable, or (3) set `N8N_BLOCK_FILE_PATTERNS` to a backtracking-safe equivalent pattern. These workarounds do not fully remediate the risk and should only be used as short-term measures.