Executive brief
n8n is a workflow automation platform that uses a Git node to clone repositories. The Git node contains a vulnerable regular expression in its default file blocking pattern that causes catastrophic backtracking when processing crafted file paths. An authenticated user can trigger this by executing a workflow with a malicious path, freezing the entire n8n instance for all users without any special configuration or privileges.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) flaw in n8n's default N8N_BLOCK_FILE_PATTERNS regular expression. The vulnerable pattern is evaluated synchronously in the main n8n process when the Git node's clone operation validates the destination path against this pattern. A crafted file path triggers catastrophic backtracking in the regex engine, causing the evaluation to consume excessive CPU and freeze the instance. An authenticated user with workflow execution privileges can exploit this with no user interaction required. The patch rewrite the pattern to use linear-time matching instead of backtracking-prone syntax. Patches are available in versions 1.123.76, 2.37.7, and 2.38.2.
Affected products
- n8n n8n < 1.123.76, >= 2.0.0 and < 2.37.7, >= 2.38.0 and < 2.38.2
Timeline
- 2026-09-10: disclosed: Published in GitHub Advisory Database
- 2026-09-02: patched: Fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2