CVE-2026-86075

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.37.7 n8n versions prior to 2.38.2

Description The OAuth Dynamic Client Registration endpoint fails to properly validate the size of the client name and grant types variables, while only bounding redirect uris. An unauthenticated remote caller can submit arbitrarily large values for these variables, which are then persisted in the oauth clients table. This can lead to the exhaustion of database storage through repeated registrations. The issue resides in the packages/cli/src/modules/oauth-server/oauth-server.service.ts file, specifically involving MAX CLIENT NAME LENGTH and MAX GRANT TYPES.

Recommendations Update to version 2.37.7 or later. Update to version 2.38.2 or later. Restrict network access to the instance so only trusted clients can reach it. Configure a reverse proxy to enforce strict request body size limits below 16 MiB. Monitor database size for unexpected growth and audit the oauth clients table for anomalous entries.