CVE-2026-110848

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.83 n8n versions 2.x prior to 2.41.4 n8n versions 2.42.x prior to 2.42.1

Description The AI workflow builder fails to check for reserved keys when merging workflow connections using node names as object members. Authenticated users can exploit this by creating nodes named proto via the API and invoking the connect-nodes operation. This leads to prototype pollution, where the global object prototype is modified, potentially disrupting the instance until it is restarted.

Recommendations Update n8n to version 1.123.83 or later. Update n8n 2.x to version 2.41.4 or later. Update n8n 2.42.x to version 2.42.1 or later.