CVE-2026-77082: Inefficient Regular Expression Complexity in n8n-io n8n
Description
n8n versions before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain a regular expression denial of service (ReDoS) vulnerability in the Filter and Switch nodes. This vulnerability arises because user-supplied regex patterns are compiled and executed synchronously without complexity checks or timeouts, allowing crafted patterns to block the worker thread and delay workflow executions.
CVSS v4.0
Score 5.3medium
Affected software
n8n-io
n8n
n8n-io
n8n
n8n-io
n8n
pkg:github/n8n-io/n8nRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-77082 is a ReDoS vulnerability affecting n8n workflow automation software. The Filter and Switch nodes compile user-provided regular expressions using new RegExp() and execute them synchronously on the worker thread without validating regex complexity or enforcing execution timeouts. Maliciously crafted regex patterns can cause the worker thread to block for extended periods per data item processed, resulting in denial of service by delaying other workflows on the same worker.
Potential Impact
An attacker can supply a specially crafted regex pattern to the Filter or Switch nodes, causing the worker thread to become unresponsive for extended durations. This leads to denial of service conditions by delaying or blocking other workflow executions on the affected worker. There is no indication of privilege escalation, data leakage, or remote code execution from the provided data.
Mitigation Recommendations
A fix is available in n8n versions 1.123.69, 2.33.4, and 2.34.1. Users should upgrade to these or later versions to remediate the vulnerability. No additional mitigation steps are indicated in the provided data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-20T10:55:09.093Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a86e708acd9273b498befd4
Added to database: 08/20/2026, 11:37:44 UTC
Last enriched: 09/11/2026, 05:03:14 UTC
Last updated: 10/04/2026, 16:08:41 UTC
Views: 62
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.