Executive brief
n8n is an automation platform used to connect different software services and automate business workflows. A vulnerability in its file decompression feature allows an attacker to crash the entire service by sending a specially crafted, highly compressed file (a 'zip bomb'). This results in a total service outage, stopping all active business automations until the system is manually restarted.
Technical details
A Denial of Service (DoS) vulnerability exists in n8n's Compression node due to improper handling of highly compressed data (CWE-409). The 'Decompress' operation attempts to expand archives into memory without enforcing size limits or entry counts. An unauthenticated remote attacker can exploit this by sending a 'zip bomb' to a public webhook workflow that utilizes the Compression node. This causes the n8n process to exhaust available memory and terminate, disrupting all workflows on the instance. The issue is resolved in version 2.24.0, which introduces configurable limits via environment variables.
Affected products
- n8n-io n8n < 2.24.0
Timeline
- 2026-06-10: advisory: GitHub advisory published by vendor
- 2026-06-23: disclosed: NVD publication date