CVE-2026-118646

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.85 n8n versions prior to 2.43.5 n8n versions prior to 2.44.1

Description Authenticated members can cause a regular expression denial of service by submitting crafted glob patterns within the File(s) Selector. This occurs when wildcard-heavy patterns trigger exponential backtracking, which blocks the event loop. Consequently, the UI, API, webhooks, and health checks become unresponsive, requiring a system restart to restore functionality.

Recommendations Update n8n to version 1.123.85 or later. Update n8n to version 2.43.5 or later. Update n8n to version 2.44.1 or later.