CVE-2026-77082: n8n ReDoS — MEDIUM

CISO Take

n8n's Filter and Switch nodes compile user-supplied regular expressions with new RegExp() and run them synchronously on the worker thread, with no complexity check or execution timeout, so a crafted pattern with catastrophic backtracking can freeze that worker for an extended period per data item. This isn't remote code execution or data exposure, but n8n is widely used as the orchestration layer for AI agent workflows, and this package alone has 201 other recorded CVEs plus a middling OpenSSF Scorecard of 6.6/10 — a track record that should raise the bar for how much untrusted input teams let flow into node configuration. There's no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template yet, so exploitation likelihood is currently low, but the attack requires no special privileges beyond the ability to influence a Filter/Switch pattern (e.g., via a shared workflow, webhook payload, or workflow template import). Patch to n8n 1.123.69, 2.33.4, or 2.34.1 immediately if you self-host n8n for agentic automation, and in the interim treat any regex field fed by external or shared-workflow input as untrusted, since a single stalled worker delays every other workflow execution scheduled on it — including any AI agent tool calls in flight.

Sources:NVDGitHub AdvisoryOpenSSFATLASvulncheck.com

What is the risk?

Medium severity, availability-only impact with no data exposure or code execution. No active exploitation signals (not in CISA KEV, no EPSS score published, no public PoC or Nuclei template), which lowers near-term urgency. However, the vulnerability class (CWE-1333, uncontrolled regex complexity) is well-understood and trivial to weaponize once an attacker can supply or influence a Filter/Switch regex pattern — the barrier to exploitation is low even though current exploitation telemetry is quiet. The larger risk signal is contextual: n8n carries 201 other recorded CVEs and a 6.6/10 OpenSSF Scorecard, suggesting a package with a persistent stream of security issues that deserves ongoing patch discipline rather than one-off fixes.

How does the attack unfold?

Entry point

Attacker gains the ability to influence input reaching a Filter or Switch node, via a public webhook trigger, shared workflow, or imported template.

AML.T0049

Trigger ReDoS

Attacker submits or configures a regex pattern with catastrophic backtracking that the node compiles and executes synchronously on the worker thread.

AML.T0034.001

Worker stall

The worker thread blocks processing the crafted item, delaying every other workflow execution queued on that worker, including AI agent automation steps.

AML.T0029

Entry point

Attacker gains the ability to influence input reaching a Filter or Switch node, via a public webhook trigger, shared workflow, or imported template.

AML.T0049

Trigger ReDoS

Attacker submits or configures a regex pattern with catastrophic backtracking that the node compiles and executes synchronously on the worker thread.

AML.T0034.001

Worker stall

The worker thread blocks processing the crafted item, delaying every other workflow execution queued on that worker, including AI agent automation steps.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
209.2KOpenSSF 7.116 dependentsPushed yesterday44% patched~19d to patchFull package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.5%

chance of exploitation in 30 days

Higher than 41% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

Patch to n8n 1.123.69 (1.x), 2.33.4 (2.x), or 2.34.1 (2.34.x) as soon as operationally feasible — this closes the root cause by adding complexity validation/timeout to regex execution. Until patched, audit workflows for Filter/Switch nodes whose regex pattern is populated from external, user-editable, or template-imported sources and lock those fields down to admin-authored patterns only. Add worker-level monitoring for anomalous per-item processing latency or workflow execution backlogs as a detection signal for in-progress ReDoS. Where possible, run n8n workers with resource/time limits (container CPU quotas, process-level watchdogs) so a stalled worker is killed and recycled rather than blocking indefinitely.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSAgentAML.T0029- Denial of AI Service AML.T0034.001- Resource-Intensive Queries

Which compliance frameworks are affected?

This CVE is relevant to:

NIST AI RMF

MEASURE-2.7-AI system security and resilience evaluation

OWASP LLM Top 10

LLM10:2025-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-77082?

n8n's Filter and Switch nodes compile user-supplied regular expressions with new RegExp() and run them synchronously on the worker thread, with no complexity check or execution timeout, so a crafted pattern with catastrophic backtracking can freeze that worker for an extended period per data item. This isn't remote code execution or data exposure, but n8n is widely used as the orchestration layer for AI agent workflows, and this package alone has 201 other recorded CVEs plus a middling OpenSSF Scorecard of 6.6/10 — a track record that should raise the bar for how much untrusted input teams let flow into node configuration. There's no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template yet, so exploitation likelihood is currently low, but the attack requires no special privileges beyond the ability to influence a Filter/Switch pattern (e.g., via a shared workflow, webhook payload, or workflow template import). Patch to n8n 1.123.69, 2.33.4, or 2.34.1 immediately if you self-host n8n for agentic automation, and in the interim treat any regex field fed by external or shared-workflow input as untrusted, since a single stalled worker delays every other workflow execution scheduled on it — including any AI agent tool calls in flight.

Is CVE-2026-77082 actively exploited?

No confirmed active exploitation of CVE-2026-77082 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-77082?

Patch to n8n 1.123.69 (1.x), 2.33.4 (2.x), or 2.34.1 (2.34.x) as soon as operationally feasible — this closes the root cause by adding complexity validation/timeout to regex execution. Until patched, audit workflows for Filter/Switch nodes whose regex pattern is populated from external, user-editable, or template-imported sources and lock those fields down to admin-authored patterns only. Add worker-level monitoring for anomalous per-item processing latency or workflow execution backlogs as a detection signal for in-progress ReDoS. Where possible, run n8n workers with resource/time limits (container CPU quotas, process-level watchdogs) so a stalled worker is killed and recycled rather than blocking indefinitely.

What systems are affected by CVE-2026-77082?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks.

What is the CVSS score for CVE-2026-77082?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworks

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0034.001Resource-Intensive Queries

Compliance Controls Affected

NIST AI RMF: MEASURE-2.7

OWASP LLM Top 10: LLM10:2025

What are the technical details?

Original Advisory

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service (ReDoS) vulnerability in the Filter and Switch nodes, which compile user-supplied regex patterns with new RegExp() and execute them synchronously on the worker thread without complexity validation or execution timeout. A crafted regex pattern can block the worker for an extended period per data item processed, delaying other workflow executions on the same worker.

Exploitation Scenario

An attacker with the ability to submit data into an n8n workflow that uses a Filter or Switch node — for example via a public webhook trigger, a shared workflow imported from an untrusted template repository, or a multi-tenant n8n instance where lower-privilege users can edit node configuration — crafts a regex pattern known to cause catastrophic backtracking (e.g., nested quantifiers like (a+)+$) and either embeds it in the node's pattern field (if editable) or triggers it against a data item designed to maximize backtracking against an existing pattern. When the workflow executes, the worker thread synchronously evaluates the regex per data item and hangs, delaying every other workflow scheduled on that worker — including any AI agent automations depending on timely tool execution — effectively degrading the automation platform's availability without needing credentials beyond workflow-trigger access.

Weaknesses (CWE)

CWE-1333Inefficient Regular Expression ComplexityPrimary CWE-1333Inefficient Regular Expression Complexity

CWE-1333 — Inefficient Regular Expression Complexity: The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

[Architecture and Design] Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
[System Configuration] Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.

Source: MITRE CWE corpus.