PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-77082 n8n-io CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-20T12:16:39.717Z and has not been modified since then. The n8n workflow automation tool contains a regular expression denial of service (ReDoS) vulnerability in its Filter and Switch nodes. These nodes compile user-supplied regex patterns using new RegExp() and execute them synchronously on the worker thread without complexity validation or execution timeouts. An attacker could craft a regex pattern that, when processed, blocks the worker thread for an extended period, delaying other workflow executions on the same worker. This issue affects n8n versions before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1. Organizations using n8n should prioritize patching to prevent potential ReDoS attacks. The vulnerability is located in the Filter and Switch nodes, which compile user-supplied regex patterns synchronously without validation or timeout. A crafted regex can cause extended worker thread blocking, delaying other workflow executions.

Vendor
n8n-io
Product
n8n
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-20
Original CVE updated
2026-09-01
Advisory published
2026-08-20
Advisory updated
2026-09-01

Who should care

DevOps teams using n8n for workflow automation, security teams responsible for monitoring and protecting workflow systems, and administrators managing n8n deployments should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The n8n workflow automation tool contains a regular expression denial of service (ReDoS) vulnerability in its Filter and Switch nodes. These nodes compile user-supplied regex patterns using new RegExp() and execute them synchronously on the worker thread without complexity validation or execution timeouts. An attacker could craft a regex pattern that, when processed, blocks the worker thread for an extended period, delaying other workflow executions on the same worker. This issue affects n8n versions before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1.

Defensive priority

Organizations using n8n should prioritize patching to prevent potential ReDoS attacks.

Recommended defensive actions

  • Inventory and triage of n8n instances
  • Patch n8n to version 1.123.69 or later, 2.33.4 or later, or 2.34.1 or later
  • Implement compensating controls such as workflow monitoring and timeouts
  • Restrict user input for regex patterns in Filter and Switch nodes
  • Monitor for suspicious workflow execution delays

Evidence notes

The CVE-2026-77082 record indicates a ReDoS vulnerability in n8n versions before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1. The vulnerability is located in the Filter and Switch nodes, which compile user-supplied regex patterns synchronously without validation or timeout. A crafted regex can cause extended worker thread blocking, delaying other workflow executions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-77082 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-77082

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-77082 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-77082

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.