CVE-2026-72749
Received Received - Intake

Prototype Pollution in n8n Leading to DoS

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: VulnCheck

Description
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated user to name a field after an inherited built-in method path and corrupt a shared global in the main Node.js process. Because that global is used on the request-authentication path, the instance then fails every authenticated request, causing an instance-wide denial of service for all users until the process is restarted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72749
EUVD
EUVD-2026-56139

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
n8n n8n to 1.123.67 (exc)
n8n n8n 2.31.5
n8n n8n 2.32.1
n8n n8n to 2.31.5 (exc)
n8n n8n to 2.32.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-72749 is a prototype pollution vulnerability in n8n, an open-source workflow automation tool. It affects versions before 1.123.67, 2.31.5, and 2.32.1. The issue occurs in the Edit Fields (Set) node where field names can be manipulated using dot-notation paths to target inherited built-in methods. This corrupts a shared global object in the Node.js process, disrupting request authentication and causing an instance-wide denial of service for all users until the process is restarted.

Detection Guidance

Check n8n version with 'n8n --version' or inspect package.json. Monitor for HTTP 500 errors indicating authentication failures. Review workflows for suspicious field names using dot-notation paths in the Edit Fields (Set) node.

Impact Analysis

This vulnerability allows an authenticated user to cause an instance-wide denial of service, making the n8n instance unavailable for all users until the process is restarted. It requires low privileges and no user interaction to exploit. The primary impact is system unavailability, as all authenticated requests fail due to corrupted request authentication.

Compliance Impact

This vulnerability causes an instance-wide denial of service by disrupting request authentication, which could lead to unauthorized access or data breaches if exploited. For GDPR, this may violate integrity and availability requirements under Article 32. For HIPAA, it could compromise the availability of protected health information systems.

Mitigation Strategies

Upgrade n8n to versions 1.123.67, 2.31.5, or 2.32.1 or later. Restrict workflow creation to trusted users. Disable untrusted user access temporarily. Monitor for unusual activity and restart the process if corruption is suspected.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72749. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart