n8n versions prior to 1.123.32, 2.17.4, and 2.18.1 are vulnerable to an unauthenticated denial of service via the MCP OAuth client registration endpoint. This endpoint accepted unauthenticated requests and stored client data without adequate resource controls, allowing an attacker to exhaust server memory by sending large registration payloads. The vulnerability exists regardless of whether MCP access is enabled on the instance. Patches are available in versions 1.123.32, 2.17.4, and 2.18.1. Temporary mitigations include restricting network access and reducing maximum payload size.