CVE-2026-86075: CWE-770: Allocation of Resources Without Limits or Throttling in n8n-io n8n
Affects n8n-io n8nSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.6% chance of exploitation in 30 days – higher than 48% of CVEs
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| n8n-ion8n | Affected
| Fixed in– |
GitHub Actionsn8n-io/n8npkg:github/n8n-io/n8nOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade n8n to version 2.37.7 or 2.38.2 or later, where proper validation limits on client_name and grant_types have been implemented to prevent resource exhaustion. Patch status is confirmed fixed in these versions. No additional mitigations are specified.
Description
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirect_uris but accepted arbitrarily large client_name and grant_types values. An unauthenticated remote caller could repeatedly persist oversized values in oauth_clients and exhaust database storage. The affected validation is in packages/cli/src/modules/oauth-server/oauth-server.service.ts, including MAX_CLIENT_NAME_LENGTH and MAX_GRANT_TYPES. This issue is fixed in versions 2.37.7 and 2.38.2.
Summary
n8n versions before 2.37.7 and 2.38.2 contain a resource exhaustion vulnerability (CWE-770) in the OAuth Dynamic Client Registration endpoint. While redirect_uris were bounded, the client_name and grant_types parameters were not properly limited, enabling unauthenticated remote attackers to store excessively large values in the oauth_clients database table. This can lead to database storage exhaustion and potential denial of service. The vulnerability is addressed by adding maximum length validations (MAX_CLIENT_NAME_LENGTH and MAX_GRANT_TYPES) in the oauth-server.service.ts module. No known exploits in the wild have been reported.
Impact
An unauthenticated attacker can repeatedly submit oversized client_name and grant_types values to the OAuth Dynamic Client Registration endpoint, causing the oauth_clients database to fill up. This resource exhaustion can degrade service availability or cause denial of service conditions in affected n8n instances.
Weaknesses
References
Community reviews
Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.