CVE-2026-72749

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.67 n8n versions prior to 2.31.5 n8n versions prior to 2.32.1

Description A prototype pollution issue exists in the Edit Fields (Set) node. This occurs because the node assigns output fields using a dot-notation path setter without restricting the field name. An authenticated user can name a field after an inherited built-in method path to corrupt a shared global in the main Node.js process. Since this global is utilized during the request-authentication path, the instance will fail all authenticated requests, resulting in a denial of service for all users until the process is restarted. Prototype pollution is a technique where an attacker manipulates the prototype of an object to inject properties that are inherited by other objects.

Recommendations Update n8n to version 1.123.67 or later. Update n8n to version 2.31.5 or later. Update n8n to version 2.32.1 or later.