CVE-2026-77082: n8n before 1.123.69 ReDoS via Filter and Switch Node
n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service (ReDoS) vulnerability in the Filter and Switch nodes, which compile user-supplied regex patterns with new RegExp() and execute them synchronously on the worker thread without complexity validation or execution timeout. A crafted regex pattern can block the worker for an extended period per data item processed, delaying other workflow executions on the same worker.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running n8n versions before 1.123.69, 2.x before 2.33.4, or 2.34.x before 2.34.1 are affected when workflows use Filter or Switch nodes with user-supplied regular expression patterns.
What does an attacker need to exploit this issue?
An attacker needs a way to supply a crafted regular expression pattern to a Filter or Switch node. The vulnerable nodes compile the pattern with new RegExp() and run it synchronously on the worker thread.
What is the operational impact?
A crafted pattern can block a worker for an extended period for each processed data item. This delays other workflow executions assigned to the same worker.
How can I reduce exposure before updating?
Avoid allowing untrusted users or inputs to control regex patterns in Filter and Switch nodes. Review workflows using these nodes for dynamically supplied patterns and remove or restrict them where possible.