CVE-2026-86081: CVE-2026-86081: Regular Expression Denial of Service in n8n Git Node

#security #cve #cybersecurity

CVE-2026-86081: Regular Expression Denial of Service in n8n Git Node

Vulnerability ID: CVE-2026-86081
CVSS Score: 7.1
Published: 2026-09-10

A Regular Expression Denial of Service (ReDoS) vulnerability exists in n8n due to inefficient validation in its default blocked-file-pattern matching mechanism. This flaw can be triggered during Git operations, allowing authenticated workflow editors to cause resource exhaustion and completely freeze the n8n application process.

TL;DR

An authenticated user with workflow editing privileges can trigger exponential backtracking in n8n's file validation regular expression, blocking the single-threaded Node.js event loop and rendering the entire instance unavailable.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-1333
Attack Vector: Network
CVSS v4.0 Score: 7.1
EPSS Score: 0.00322
Exploit Status: poc
CISA KEV Status: Not Listed

Affected Systems

n8n Workflow Automation Platform
n8n: < 1.123.76 (Fixed in: 1.123.76)
n8n: >= 2.0.0 < 2.37.7 (Fixed in: 2.37.7)
n8n: >= 2.38.0 < 2.38.2 (Fixed in: 2.38.2)

Mitigation Strategies

Upgrade n8n deployment to a patched release containing the hardened regular expression.
Define the environment variable N8N_BLOCK_FILE_PATTERNS using the secure regex to override the vulnerable default configuration.

Remediation Steps:

For Docker-based deployments, update the container image tag to 1.123.76, 2.37.7, or 2.38.2.
If immediate patching is unavailable, append N8N_BLOCK_FILE_PATTERNS='^(?:[^/]*/)*\.git(?:/.*)?$' to the server environment variables.
Restart the n8n service to apply the updated environment configuration.

References

Read the full report for CVE-2026-86081 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community