CVE-2026-118646: n8n: ReDoS in File(s) Selector glob blocks event loop

MEDIUM

Published October 28, 2026

CISO Take

A ReDoS flaw in n8n's File(s) Selector glob handling lets any authenticated member who can create and run workflows freeze the entire instance with one wildcard-heavy pattern, taking down the UI, API, webhooks and health checks until a manual restart. The CVSS is a moderate 6.5, and there is no EPSS score, no public exploit, no Nuclei template and no CISA KEV listing, so near-term mass exploitation looks unlikely. The risk is still real for organizations that run n8n as AI agent and automation glue, because a single low-privilege user, or a compromised member account, can halt every webhook-triggered AI workflow at once. Upgrade to n8n 1.123.85, 2.43.5 or 2.44.1 or later, and until then limit workflow creation to trusted users and monitor for event loop stalls and failed health checks.

Sources:NVDGitHub Advisoryvulncheck.comATLAS

What is the risk?

Medium. Exploitation is network-reachable, low complexity, needs only a low-privilege authenticated account and no user interaction, and the impact is availability only (A:H, no confidentiality or integrity impact). There is no known exploitation, EPSS data, public PoC or scanner template. Exposure depends on how many users can author workflows. Multi-tenant or shared n8n instances, and those with self-service workflow creation, carry the highest risk. Because n8n is single-threaded for the event loop, one request can stop the whole instance, including unrelated workflows.

How does the attack unfold?

Initial Access

Attacker logs in with a low-privilege n8n member account that can create and run workflows.

AML.T0012

Exploitation

Attacker submits a wildcard-heavy File(s) Selector glob pattern that triggers exponential regex backtracking.

AML.T0034.001

Impact

The Node.js event loop blocks, making the UI, API, webhooks and health checks unresponsive until restart, which halts AI agent workflows.

AML.T0029

Initial Access

Attacker logs in with a low-privilege n8n member account that can create and run workflows.

AML.T0012

Exploitation

Attacker submits a wildcard-heavy File(s) Selector glob pattern that triggers exponential regex backtracking.

AML.T0034.001

Impact

The Node.js event loop blocks, making the UI, API, webhooks and health checks unresponsive until restart, which halts AI agent workflows.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
208.5KOpenSSF 7.116 dependentsPushed 7d ago44% patched~19d to patchFull package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 16% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Upgrade n8n to 1.123.85, 2.43.5, 2.44.1 or later. 2) Until patched, restrict workflow creation and execution rights to trusted users and review member accounts. 3) Audit existing workflows for Read/Write Files nodes with unusually wildcard-heavy File(s) Selector patterns (many consecutive * or ** segments). 4) Disable or restrict the Read/Write Files from Disk node where not needed, for example through the NODES_EXCLUDE setting. 5) Monitor for event loop lag, CPU pinned at 100% on a single core, and failing health checks, and alert on them. 6) Run n8n with a process supervisor and consider queue mode with separate workers so a stall in one execution does not take down the full service. 7) Apply least privilege and SSO or MFA to member accounts to reduce account-takeover paths.

How is it classified?

DoSAgentFrameworkAML.T0012- Valid Accounts AML.T0029- Denial of AI Service AML.T0034.001- Resource-Intensive Queries

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks and resilience of AI systems

OWASP LLM Top 10

LLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-118646?

Is CVE-2026-118646 actively exploited?

No confirmed active exploitation of CVE-2026-118646 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-118646?

1) Upgrade n8n to 1.123.85, 2.43.5, 2.44.1 or later. 2) Until patched, restrict workflow creation and execution rights to trusted users and review member accounts. 3) Audit existing workflows for Read/Write Files nodes with unusually wildcard-heavy File(s) Selector patterns (many consecutive * or ** segments). 4) Disable or restrict the Read/Write Files from Disk node where not needed, for example through the NODES_EXCLUDE setting. 5) Monitor for event loop lag, CPU pinned at 100% on a single core, and failing health checks, and alert on them. 6) Run n8n with a process supervisor and consider queue mode with separate workers so a stall in one execution does not take down the full service. 7) Apply least privilege and SSO or MFA to member accounts to reduce account-takeover paths.

What systems are affected by CVE-2026-118646?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation platforms, LLM orchestration pipelines, webhook-driven AI automations.

What is the CVSS score for CVE-2026-118646?

CVE-2026-118646 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.25%.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow automation platformsLLM orchestration pipelineswebhook-driven AI automations

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0029Denial of AI Service

AML.T0034.001Resource-Intensive Queries

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service vulnerability that allows authenticated members to block the event loop via crafted glob patterns. Attackers who can create and run workflows can submit a wildcard-heavy File(s) Selector pattern causing exponential backtracking, making the UI, API, webhooks, and health checks unresponsive until restart.

Exploitation Scenario

An attacker obtains a low-privilege member account on a shared n8n instance, for example through credential stuffing or a phished employee. They create a workflow with a Read/Write Files from Disk node and set the File(s) Selector to a pattern containing many nested wildcards that triggers exponential regex backtracking, then run it. The Node.js event loop locks up, so webhooks feeding AI agent pipelines, the editor UI and the health endpoint stop responding. The attacker can repeat this after every restart to sustain the outage, or save the workflow with a trigger so it re-fires automatically.

Weaknesses (CWE)

CWE-1333Inefficient Regular Expression ComplexityPrimary CWE-1333Inefficient Regular Expression Complexity

CWE-1333 — Inefficient Regular Expression Complexity: The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

[Architecture and Design] Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
[System Configuration] Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.

Source: MITRE CWE corpus.