GHSA-j535-v25q-vx3q: Npm/n8n vulnerability
Impact
The Git node's clone operation matched the destination path against the default N8NBLOCKFILEPATTERNS expression, which was written so that a crafted path caused catastrophic backtracking. Evaluation runs synchronously in the main n8n process, so an authenticated user could freeze the instance for everyone with a single workflow execution and no unusual configuration. The patch rewrites the pattern so that matching is linear in the length of the path.
Patches
The issue has been fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict n8n instance access to fully trusted users only. - Disable the Git node by adding n8n-nodes-base.git to the NODESEXCLUDE environment variable. - Set N8NBLOCKFILEPATTERNS to a backtracking-safe equivalent pattern to replace the vulnerable default.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.37.7 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.38.2 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 1.123.76 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.76 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.37.7 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.38.2 - Configuration
Temporarily disable the Git node by adding `n8n-nodes-base.git` to the `NODES_EXCLUDE` environment variable.
n8n NODES_EXCLUDE = n8n-nodes-base.git - Configuration
As a short-term mitigation, set `N8N_BLOCK_FILE_PATTERNS` to a backtracking-safe equivalent pattern to replace the vulnerable default.
n8n N8N_BLOCK_FILE_PATTERNS = backtracking-safe equivalent pattern - Compensating control
Restrict the n8n instance access to fully trusted users only.
Event History
Frequently Asked Questions
Who can exploit this issue in a typical deployment?
An authenticated n8n user who can execute a workflow using the Git node can trigger the vulnerable clone-path matching. The issue affects the default file-pattern configuration, so no unusual configuration is required.
What is the practical impact of successful exploitation?
A crafted destination path can cause catastrophic regular-expression backtracking during Git clone processing. Because evaluation occurs synchronously in the main n8n process, one workflow execution can freeze the instance for all users.
Which versions contain the fix?
Upgrade to n8n 1.123.76, 2.37.7, or 2.38.2, or any later version. The fix replaces the vulnerable pattern with one whose matching time is linear in the path length.
What can be done before an upgrade is possible?
Limit access to fully trusted users, disable the Git node by adding n8n-nodes-base.git to NODES_EXCLUDE, or replace N8N_BLOCK_FILE_PATTERNS with a backtracking-safe equivalent. These are temporary mitigations and do not fully remediate the issue.