CVE-2026-54314
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk29th percentile — higher than 29% of all known CVEs
Summary
n8n is a workflow automation platform that prior to version 2.24.0 had an issue with the Compression node allowing attacker-controlled archives to be decompressed without limits on output size. An attacker could send a small compressed archive to a public webhook, causing memory exhaustion and terminating the n8n process.
Risk Assessment
This vulnerability could lead to the failure of all workflows in the same n8n instance, disrupting the organization's operations and automation.
Recommendation
It is recommended to upgrade to version 2.24.0 or later to mitigate this vulnerability and secure the system against potential attacks.
Original NVD description (English source)
n8n is an open source workflow automation platform. Prior to 2.24.0, the Compression node's Decompress operation expanded attacker-controlled archives into memory without enforcing limits on decompressed output size. An unauthenticated attacker could send a small compressed archive to a public webhook workflow using this node, causing the n8n process to terminate due to memory exhaustion and disrupting all workflows in the same instance. This vulnerability is fixed in 2.24.0.