CVE-2026-118678

CVE-2026-118678 · n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged users to alter built-in object behaviour by saving workflows with specially named connection keys. Attackers can add keys such as __proto__ to workflow connections, which the periodic history compaction task processes, causing logins and writes to fail with server errors.

CVSS 7.1 · Alta · EPSS 0,3% · Corrección disponible

Publicación: 2026-10-28T18:59:50.449Z
Actualización: 2026-10-29T20:54:29.021Z

Productos y versiones afectados

n8n
Versiones
- ≥ 0, < 2.41.4: Afectada (semver)
- 2.41.4: No afectada (semver)
Actualiza a 2.41.4
n8n
Versiones
- ≥ 2.42.0, < 2.42.1: Afectada (semver)
- 2.42.1: No afectada (semver)
Actualiza a 2.42.1

Fuentes originales

Comprueba tu servidor →