GHSA-fvv4-gmv9-xqf5: n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction

Published Oct 28, 2026

Updated

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged users to alter built-in object behaviour by saving workflows with specially named connection keys. Attackers can add keys such as proto to workflow connections, which the periodic history compaction task processes, causing logins and writes to fail with server errors.

Event History

Oct 28, 2026

CVE Published

via OSV·06:59 PM

Data Sourced

via OSV·06:59 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A low-privileged n8n user who can save a workflow can exploit it by creating workflow connection keys with specially named properties such as __proto__.

Does exploitation require user interaction or prior administrative access?

No user interaction is required. The attacker needs low-privileged access sufficient to save workflows; the issue is triggered when the periodic workflow-history compaction task processes the crafted connections.

What is the operational impact after successful exploitation?

Prototype pollution can alter built-in object behavior, causing logins and write operations to fail with server errors. This can result in a denial of service affecting availability.

Which releases should be remediated?

Affected releases are n8n versions before 2.41.4 and the 2.42.x line before 2.42.1. Upgrade to 2.41.4 or 2.42.1 or later, as appropriate for the deployed release line.

GHSA-fvv4-gmv9-xqf5: n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction

Event History

Frequently Asked Questions

Who can exploit this issue?

Does exploitation require user interaction or prior administrative access?

What is the operational impact after successful exploitation?

Which releases should be remediated?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Does exploitation require user interaction or prior administrative access?

What is the operational impact after successful exploitation?

Which releases should be remediated?