CVE-2026-86081

n8n, an open source workflow automation platform, is vulnerable to a regular expression denial-of-service flaw (catastrophic backtracking, CWE-1333) in the Git node's clone operation. When a workflow using the Git node clone runs, the attacker-controlled destination path is matched against the default N8N_BLOCK_FILE_PATTERNS regular expression (declared in packages/@n8n/config/src/configs/security.config.ts), whose pattern ^(./).git(/.)$ allows catastrophic backtracking and executes synchronously in the main n8n process. An authenticated workflow editor can therefore freeze the entire instance with a single workflow execution, causing denial of service with no confidentiality or integrity impact (CVSS 4.0: 7.1 High). All n8n deployments prior to versions 1.123.76, 2.37.7, and 2.38.2 are affected, particularly self-hosted instances that allow non-admin users to create and run workflows. No public proof-of-concept or in-the-wild exploitation is known; EPSS currently estimates a 0.3% chance of exploitation within 30 days and the issue is not in CISA KEV.

What to do: Upgrade n8n to version 1.123.76, 2.37.7, or 2.38.2 (or later). Until patched, restrict workflow creation/editing to trusted users and review whether any user-authored workflows invoke the Git node's clone operation; as an interim mitigation, consider overriding the default N8N_BLOCK_FILE_PATTERNS setting with a non-backtracking expression. There is no evidence of active exploitation, but exposed instances that allow untrusted editors should be patched promptly.