CVE Feed

    Dashboard / CVE / CVE-2026-118646

    CVE-2026-118646

    n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service vulnerability that allows authenticated members to block the event loop via crafted glob patterns. Attackers who can create and run workflows can submit a wildcard-heavy File(s) Selector pattern causing exponential backtracking, making the UI, API, webhooks, and health checks unresponsive until restart.

    Published:Oct 28, 2026
    Last Modified:Oct 28, 2026
    EPS:Oct 28, 2026
    EPSS Score:
    CVSS Score:6.5

    Affected Products

    Vendor
    N8n
    Product
    N8n

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-492 Regular Expression Exponential Blowup

    Related CVEs

    CVE-2026-119557 (CVSS 8.2) — n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unau…
    CVE-2026-119408 (CVSS 8.7) — n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability v…
    CVE-2026-118679 (CVSS 6.9) — n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trig…
    CVE-2026-118678 (CVSS 7.1) — n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privil…
    CVE-2026-118677 (CVSS 5.9) — n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulnerability in the Local Gateway …
    CVE-2026-118676 (CVSS 5.1) — n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows member user…
    CVE-2026-118675 (CVSS 5.1) — n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors o…
    CVE-2026-118649 (CVSS 8.7) — n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's ow…
    CVE-2026-118648 (CVSS 8.4) — n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulner…
    CVE-2026-118647 (CVSS 5.3) — n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token i…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High