CVE-2026-86081
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node clone operation matched an attacker-controlled destination path against the default N8N_BLOCK_FILE_PATTERNS regular expression. The pattern ^(./).git(/.)$ allowed catastrophic backtracking and ran synchronously in the main n8n process. An authenticated workflow editor could therefore freeze the instance with one workflow execution; the affected default is declared in packages/@n8n/config/src/configs/security.config.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.1
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.32%
- CWE
- CWE-1333
- Published
- 2026-09-08
- Last modified
- 2026-09-09
Affected products
- n8n-io n8n
- n8n-io n8n
- n8n-io n8n
Weakness type
Related vulnerabilities
- CVE-2026-75880 — Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service
- CVE-2026-87819 — GitPython before 3.1.60 Denial of Service via ReDoS
- CVE-2026-85062 — Colord: Slow rejection of oversized malformed color strings
- CVE-2026-83619 — xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser
- CVE-2026-83606 — xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions
- CVE-2024-58379 — nodemailer before 6.9.9 ReDoS via attachDataUrls parameter
- CVE-2026-55520 — Protego: Exponential backtracking ReDoS in robots.txt URL wildcard matching
- CVE-2026-80206 — NLTK 3.10.2 Regular Expression Denial of Service via tgrep