CVE-2026-72749: n8n

Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days.

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated user to name a field after an inherited built-in method path and corrupt a shared global in the main Node.js process. Because that global is used on the request-authentication path, the instance then fails every authenticated request, causing an instance-wide denial of service for all users until the process is restarted.

Affected products

• n8n n8n: before 1.123.67 (fixed in 1.123.67); from 2.31.0, before 2.31.5 (fixed in 2.31.5); version 2.32.0 only

Published 2026-08-11. Last modified 2026-09-01.