Listen to this Post
CVE-2026-86081 is a Regular Expression Denial of Service (ReDoS) vulnerability in n8n, an open-source workflow automation platform. The flaw resides in the Git node’s clone operation, which validates the destination path against a default regular expression defined by the `N8N_BLOCK_FILE_PATTERNS` environment variable. Prior to the patched versions, this default pattern was implemented as ^(./).git(/.)$. This regex contains nested quantifiers and ambiguous matching boundaries that exhibit catastrophic backtracking when evaluated against specifically crafted input strings. Catastrophic backtracking occurs when the regex engine explores an exponential number of possible match combinations, causing processing time to grow dramatically with input length.
The critical impact stems from the execution context: the pattern matching runs synchronously within the main n8n process. n8n’s architecture relies on a single-threaded Node.js event loop for core operations. When an authenticated user with workflow editing privileges configures a Git node with a malicious destination path and executes the workflow, the regex engine enters a state of exponential evaluation. This blocks the main event loop entirely, rendering the n8n instance unresponsive to all users and all requests. The attacker requires only valid credentials and workflow editing permissions—no unusual configuration or elevated privileges are necessary. A single workflow execution is sufficient to freeze the instance indefinitely until the process is manually restarted or terminated by external constraints. The vulnerability is classified as CWE-1333 (Inefficient Regular Expression Complexity) and carries a CVSS v4.0 score of 7.1, reflecting high availability impact with low attack complexity and low privileges required. The patch rewrites the regex pattern to ensure matching remains linear in the length of the destination path, eliminating the exponential backtracking behavior.
DailyCVE Form:
Platform: n8n
Version: <1.123.76; 2.0.0–2.37.6; 2.38.0–2.38.1
Vulnerability: ReDoS (CWE-1333)
Severity: High (7.1)
date: September 2, 2026
Prediction: September 30, 2026
What Undercode Say
Analytics
Check affected version:
n8n --version
Identify vulnerable default pattern in source:
grep -r "N8N_BLOCK_FILE_PATTERNS" packages/@n8n/config/src/configs/security.config.ts
Trigger ReDoS via crafted path (conceptual):
In a Git node clone configuration, set destination path to a string causing catastrophic backtracking against ^(./).git(/.)$ Example: repeated segments that force exponential evaluation
Monitor process hang:
Observe n8n process CPU spike and unresponsiveness top -p $(pgrep -f "n8n")
How Exploit: (Educational Purposes!)
- Authenticate to n8n with a user account possessing workflow editing permissions.
- Create or modify a workflow containing a Git node configured for a clone operation.
- Set the destination path to a specially crafted string that induces catastrophic backtracking in the regex
^(./).git(/.)$. - Execute the workflow. The main n8n process blocks on regex evaluation, freezing the instance for all users.
- Repeat execution to maintain denial of service until process restart.
Protection: from this CVE
Upgrade n8n to version 1.123.76, 2.37.7, or 2.38.2 or later.
If immediate upgrade is not possible, apply one or more temporary mitigations:
– Restrict n8n instance access to fully trusted users only.
– Disable the Git node by adding `n8n-nodes-base.git` to the `NODES_EXCLUDE` environment variable.
– Override the vulnerable default by setting `N8N_BLOCK_FILE_PATTERNS` to a backtracking-safe equivalent, such as:
N8N_BLOCK_FILE_PATTERNS='^(?:[^/]/).git(?:/.)?$'
These workarounds are short-term mitigations only and do not fully remediate the underlying risk.
Impact
Successful exploitation results in complete denial of service against the n8n instance. The main process becomes unresponsive, blocking all workflow executions, API requests, and user interface interactions for every user connected to the platform. Recovery requires manual process restart or external intervention. The vulnerability enables an authenticated low-privileged user to cause organization-wide automation outage with a single action.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
