CVE-2026-118678: n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction
n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged users to alter built-in object behaviour by saving workflows with specially named connection keys. Attackers can add keys such as proto to workflow connections, which the periodic history compaction task processes, causing logins and writes to fail with server errors.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker needs low-privileged access sufficient to save a workflow. Exploitation does not require user interaction.
How is the denial of service triggered?
An attacker saves a workflow containing specially named connection keys, such as __proto__. The periodic workflow history compaction task subsequently processes those keys, causing prototype pollution and server errors.
What operational symptoms indicate exploitation may have occurred?
Logins and write operations can fail with server errors after the history compaction task processes a malicious workflow. The issue affects availability and integrity, but no confidentiality impact is indicated.
Which versions should be used to remediate the issue?
Upgrade to n8n 2.41.4 or later in the 2.41 release line, or 2.42.1 or later in the 2.42 release line.