CVE-2026-118646: n8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Node
n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service vulnerability that allows authenticated members to block the event loop via crafted glob patterns. Attackers who can create and run workflows can submit a wildcard-heavy File(s) Selector pattern causing exponential backtracking, making the UI, API, webhooks, and health checks unresponsive until restart.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated n8n member who can create and run workflows can exploit it. The attack uses a crafted wildcard-heavy File(s) Selector pattern in the Read/Write Files Node.
What is the operational impact if exploitation succeeds?
The crafted pattern can cause exponential regular-expression backtracking and block the event loop. The n8n UI, API, webhooks, and health checks can become unresponsive until the instance is restarted.
Which versions contain the fix?
The issue affects versions before 1.123.85, 2.43.5, and 2.44.1. Upgrade to the applicable fixed release or a later version.
How can I tell whether an instance may already be affected?
An affected instance may have its UI, API, webhooks, and health checks all become unresponsive, requiring a restart. Review workflows created or run by members for wildcard-heavy File(s) Selector patterns in Read/Write Files Nodes.