Executive brief
n8n is a workflow automation platform that allows organizations to build and execute automated processes. The /rest/binary-data endpoint in n8n contains a denial-of-service vulnerability that can be exploited by authenticated users to cause service disruption. By sending malformed requests with empty filesystem URIs to this endpoint, attackers can exhaust system resources and make the service temporarily unavailable, impacting business operations and automation workflows.
Technical details
This is a denial-of-service vulnerability (CWE-400: Uncontrolled Resource Consumption) in the /rest/binary-data endpoint that occurs when processing malformed filesystem URIs (filesystem:// or filesystem-v2://). The attack requires network access and authenticated privileges; attackers send GET requests with empty filesystem URIs to trigger resource exhaustion and cause HTTP/2 524 timeout responses. The vulnerability affects n8n versions prior to 1.99.0 and has been patched with strict URI pattern validation (PR #16229). The fix should be applied immediately to all self-hosted and cloud instances.
Affected products
- n8n n8n before 1.99.0
Timeline
- 2025-07-03: disclosed
- 2025-07-03: patched: version 1.99.0