CyberRota Analysis
AI-GeneratedThe vulnerability affects n8n versions prior to 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1, specifically in the Filter and Switch nodes, where user-supplied regex patterns can lead to a regular expression denial of service (ReDoS). An attacker can exploit this flaw by submitting a malicious regex pattern, causing significant delays in workflow execution as the worker thread becomes blocked. Organizations utilizing n8n for automation workflows should prioritize patching to mitigate potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service (ReDoS) vulnerability in the Filter and Switch nodes, which compile user-supplied regex patterns with new RegExp() and execute them synchronously on the worker thread without complexity validation or execution timeout. A crafted regex pattern can block the worker for an extended period per data item processed, delaying other workflow executions on the same worker.
Related CVEs
Other vulnerabilities affecting the same vendor(s)