Breakingsystems

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.123.67 n8n versions prior to 2.31.5 n8n versions prior to 2.32.1 **Description** A prototype pollution issue exists in the Edit Fields (Set) node. This occurs because the node assigns output fields using a dot-notation path setter without restricting the field name. An authenticated user can name a field after an inherited built-in method path to corrupt a shared global in the main Node.js process. Since this global is utilized during the request-authentication path, the instance will fail all authenticated requests, resulting in a denial of service for all users until the process is restarted. Prototype pollution is a technique where an attacker manipulates the prototype of an object to inject properties that are inherited by other objects. **Recommendations** Update n8n to version 1.123.67 or later. Update n8n to version 2.31.5 or later. Update n8n to version 2.32.1 or later.