Executive brief
n8n is a workflow automation tool used to connect different software services. A vulnerability in the 'Edit Fields (Set)' node allows an authorized user to crash the entire service for all other users. This results in a total service outage (Denial of Service) that persists until an administrator manually restarts the application.
Technical details
A prototype pollution vulnerability (CWE-1321) exists in the n8n 'Edit Fields (Set)' node. The component uses a dot-notation path setter for output fields without adequate validation, allowing an authenticated user to overwrite inherited built-in method paths. By corrupting shared globals in the main Node.js process that are utilized during the request-authentication phase, an attacker can cause all subsequent authenticated requests to fail with HTTP 500 errors. This leads to an instance-wide denial of service. The issue is resolved in versions 1.123.67, 2.31.5, and 2.32.1.
Affected products
- n8n-io n8n < 1.123.67, >= 2.0.0-rc.0 < 2.31.5, >= 2.32.0 < 2.32.1
Timeline
- 2026-07-22: disclosed
- 2026-07-22: advisory
- 2026-07-22: patched
References
- https://api.github.com/users/breakingsystems
- https://github.com/breakingsystems
- https://api.github.com/users/breakingsystems/gists%7B/gist_id%7D
- https://api.github.com/users/breakingsystems/repos
- https://avatars.githubusercontent.com/u/72152138?v=4
- https://api.github.com/users/breakingsystems/events%7B/privacy%7D