CVE-2026-86081: n8n regular expression denial of service in Git node file pattern

CVE-2026-86081 · Severity: high · CVSS 4 · Published 2026-09-08

n8n is a workflow automation platform that uses a Git node to clone repositories. The Git node contains a vulnerable regular expression in its default file blocking pattern that causes catastrophic backtracking when processing crafted file paths. An authenticated user can trigger this by executing a workflow with a malicious path, freezing the entire n8n instance for all users without any special configuration or privileges.

Technologies: N8n, n8n (npm). Vendors: N8n, npm.

Quick answers

Is CVE-2026-86081 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-86081 being exploited in the wild.
How severe is CVE-2026-86081?
High severity, with a CVSS score of 4, published 8 September 2026.
Which products and versions are affected?
N8n < 1.123.76, >= 2.0.0 and < 2.37.7, >= 2.38.0 and < 2.38.2; n8n (npm) SEMVER:introduced=0,fixed=1.123.76.
Is there a fix for CVE-2026-86081?
Yes. n8n (npm): upgrade to 1.123.76 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86081 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-86081?
Check whether you run N8n or n8n (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • n8n (npm): upgrade to 1.123.76 or later
    npm install n8n@1.123.76

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) flaw in n8n's default N8N_BLOCK_FILE_PATTERNS regular expression. The vulnerable pattern is evaluated synchronously in the main n8n process when the Git node's clone operation validates the destination path against this pattern. A crafted file path triggers catastrophic backtracking in the regex engine, causing the evaluation to consume excessive CPU and freeze the instance. An authenticated user with workflow execution privileges can exploit this with no user interaction required. The patch rewrite the pattern to use linear-time matching instead of backtracking-prone syntax. Patches are available in versions 1.123.76, 2.37.7, and 2.38.2.

Affected products

  • n8n n8n < 1.123.76, >= 2.0.0 and < 2.37.7, >= 2.38.0 and < 2.38.2

Identifiers

  • CVE-2026-86081
  • GHSA-j535-v25q-vx3q

Timeline

  • 2026-09-10: disclosed: Published in GitHub Advisory Database
  • 2026-09-02: patched: Fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.