Executive brief
n8n is a workflow automation platform used to build and execute complex business processes. The Filter and Switch nodes allow users to define conditions based on regular expressions. A maliciously crafted regex pattern can cause the worker thread to hang indefinitely, blocking processing of other workflows and causing denial of service to legitimate users on the same instance.
Technical details
This is a regular expression denial of service (ReDoS) vulnerability in n8n's Filter and Switch nodes. The vulnerable code compiles user-supplied regex patterns using new RegExp() and executes them synchronously on the worker thread without any complexity validation or execution timeout. An attacker with access to create or modify workflows (low privilege requirement) can craft a pathological regex pattern that exhibits catastrophic backtracking, causing the worker thread to block for an extended period per data item processed. This delays or prevents other workflow executions on the same worker. The vulnerability has been patched in versions 1.123.69, 2.33.4, and 2.34.1.
Affected products
- n8n n8n before 1.123.69, 2.x before 2.33.4, 2.34.x before 2.34.1
Timeline
- 2026-08-05: disclosed: GitHub Security Advisory published
- 2026-08-20: advisory: NVD advisory published
- 2026-08-05: patched: Fixed in versions 1.123.69, 2.33.4, and 2.34.1