CVE-2026-72749
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Vulnerability in n8n before versions 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated user to name a field after an inherited built-in method path and corrupt a shared global in the main Node.js process. Because that global is used on the request-authentication path, the instance then fails every authenticated request, causing an instance-wide denial of service for all users until the process is restarted.
Risk Assessment
The risk includes complete denial of service (DoS) for all users, potentially leading to downtime and loss of productivity.
Recommendation
Upgrade n8n to versions 1.123.67, 2.31.5, or 2.32.1 which contain the fix.
Original NVD description (English source)
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated user to name a field after an inherited built-in method path and corrupt a shared global in the main Node.js process. Because that global is used on the request-authentication path, the instance then fails every authenticated request, causing an instance-wide denial of service for all users until the process is restarted.