CVE-2026-77082

MediumCVSS 4.3/10Last modified Sep 1, 2026

Description

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service (ReDoS) vulnerability in the Filter and Switch nodes, which compile user-supplied regex patterns with new RegExp() and execute them synchronously on the worker thread without complexity validation or execution timeout. A crafted regex pattern can block the worker for an extended period per data item processed, delaying other workflow executions on the same worker.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-1333

Affected software

Vendor	Product	Versions
n8n-io	n8n	< 1.123.69
n8n-io	n8n	>= 2.34.0, < 2.34.1
n8n-io	n8n	>= 2.0.0, < 2.33.4

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-q3fv-295f-qfpfMitigation, Vendor Advisory
https://www.vulncheck.com/advisories/n8n-before-redos-via-filter-and-switch-nodeThird Party Advisory

Timeline

Published: Aug 20, 2026
Last modified: Sep 1, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-770835.9n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not free CVE-2026-770848.8n8n before 1.123.69 (and 2.x before 2.33.4 / 2.34.1) contains a code execution vulnerability in the Git node. The Git node executed certain CVE-2026-770856.5n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-CVE-2026-770869.1SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administr CVE-2026-770879.6Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DN CVE-2026-770886.1justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in to_markdown() where inline code spans fail to account CVE-2026-770899.8Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenan CVE-2026-77096.3A vulnerability was identified in janeczku Calibre-Web up to 0.6.26. The impacted element is the function generate_auth_token of the file cp CVE-2026-770908.7CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolv CVE-2026-770917.8DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release CVE-2026-770929.8Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved CVE-2026-770937.1CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all