CVE-2026-44789: n8n prototype pollution in HTTP Request node

Executive brief

n8n is a popular workflow automation tool used to connect different software services. A security vulnerability in its HTTP Request component allows an authorized user to corrupt the application's internal memory structure. In practice, this could allow an attacker to take full control of the server, potentially leading to data theft or a complete service shutdown.

Technical details

A prototype pollution vulnerability exists in the n8n HTTP Request node due to unvalidated pagination parameters. An authenticated attacker with permissions to create or modify workflows can exploit this to achieve global prototype pollution (CWE-1321). By manipulating the JavaScript object prototype, the attacker can escalate this to Remote Code Execution (RCE) on the underlying instance. The vulnerability is reachable over the network but requires low-level user privileges. Patches are available in versions 1.123.43, 2.20.7, and 2.22.1.

Affected products

• n8n-io n8n < 1.123.43, >= 2.0.0-rc.0, < 2.20.7, >= 2.21.0, < 2.22.1

Timeline

• 2026-05-13: disclosed
• 2026-05-14: advisory

References

• https://api.github.com/users/sm1ee
• https://github.com/sm1ee
• https://api.github.com/users/sm1ee/gists%7B/gist_id%7D
• https://api.github.com/users/sm1ee/repos
• https://avatars.githubusercontent.com/u/19336661?v=4
• https://api.github.com/users/sm1ee/events%7B/privacy%7D