Description
n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service (ReDoS) vulnerability in the Filter and Switch nodes, which compile user-supplied regex patterns with new RegExp() and execute them synchronously on the worker thread without complexity validation or execution timeout. A crafted regex pattern can block the worker for an extended period per data item processed, delaying other workflow executions on the same worker.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n8n-io n8n
Default version status: unaffected
0 to < 1.123.69affected1.123.69unaffected
pkg:npm/n8nn8n-io n8n
Default version status: unaffected
2.34.0 to < 2.34.1affected2.34.1unaffected
pkg:npm/n8nn8n-io n8n
Default version status: unaffected
2.0.0 to < 2.33.4affected2.33.4unaffected
pkg:npm/n8n