CVE-2026-77082 — n8n before 1.123.69 ReDoS via Filter and Switch Node
n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service (ReDoS) vulnerability in the Filter and Switch nodes, which comp…
Published: 2026-08-20 · CVSS: 5.3 · CVSS 4.0
n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service (ReDoS) vulnerability in the Filter and Switch nodes, which compile user-supplied regex patterns with new RegExp() and execute them synchronously on the worker thread without complexity validation or execution timeout. A crafted regex pattern can block the worker for an extended period per data item processed, delaying other workflow executions on the same worker.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7