CVE-2026-86081: n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path

High severity · published Sep 8, 2026

CVE-2026-86081

n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path

7.1

CVSS

0.6%

EPSS

On KEV

Description

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node clone operation matched an attacker-controlled destination path against the default N8N_BLOCK_FILE_PATTERNS regular expression. The pattern ^(./).git(/.)$ allowed catastrophic backtracking and ran synchronously in the main n8n process. An authenticated workflow editor could therefore freeze the instance with one workflow execution; the affected default is declared in packages/@n8n/config/src/configs/security.config.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

Exploitation

Is it being used?

Exploit prediction (EPSS)0.6% · higher than 46% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

n8n · n8n-io

>= 2.38.0, < 2.38.2; >= 2.0.0, < 2.37.7; < 1.123.76 · source: vendor

Affected product

n8n