Live › vulnerability › CVE-2026-118646
Go to dashboardn8n contains a regular expression denial of service flaw in its File(s) Selector glob handling. An authenticated member who can create and run workflows can submit a wildcard-heavy pattern that triggers exponential backtracking and blocks the event loop, making the UI, API, webhooks and health checks unresponsive until restart.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 19:34 UTC. All times on this page are UTC.
Self-hosted or cloud n8n instances on versions before the fixed releases are exposed when someone with an account can create and run workflows that use the File(s) Selector node. Instances where only trusted administrators can author workflows carry much less risk. unknown whether instances that never use the File(s) Selector node are exposed through other glob paths.
No product ranges from the sources yet.
n8n --version or the image tag in your deployment and compare against the fixed releases below.1.123.85 on the 1.x line, 2.43.5 on the 2.43 line, or 2.44.1 on the 2.44 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service vulnerability that allows authenticated members to block the event loop via crafted glob patterns. Attackers who can create and run workflows can submit a wildcard-heavy File(s) Selector pattern causing exponential backtracking, making the UI, API, webhooks, and health checks unresponsive until restart.
This page as .md · .json · in your agent: get_signal("CVE-2026-118646")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.