EUVD-2026-101731

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named proto throu...

CVE-2026-110848

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named proto throu...

CVE-2026-110848 n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named proto throu...

CVE-2026-110848

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named proto throu...

CVE-2026-110848

The n8n workflow automation tool (versions before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1) is vulnerable to Prototype Pollution in the AI workflow builder. The root cause is the failure to check for reserved keys when merging workflow connections using node names as object members. ...

CVE-2026-110848 n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named proto throu...

CVE-2026-110848 n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named proto throu...

CVE-2026-110848: Improperly Controlled Modification of Object Prototype Attributes

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named proto throu...

PT-2026-114162

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named proto throu...

@n8n/ai-workflow-builder (1.42.0), @n8n/backend-test-utils (1.42.0) +7 more potentially affected by unknown CVE via @n8n/workflow-sdk (0.35.0)

@n8n/workflow-sdk NPM version 0.35.0 is affected by a known vulnerability. The following packages have a transitive dependency on @n8n/workflow-sdk and may be impacted: - @n8n/ai-workflow-builder 1.42.0 - @n8n/backend-test-utils 1.42.0 - @n8n/db 1.42.0 - @n8n/instance-ai 1.27.0 -...

@n8n/agents (0.17.0), @n8n/ai-node-sdk (0.22.0) +6 more potentially affected by CVE-2026-77085 via @n8n/ai-utilities (0.25.0)

@n8n/ai-utilities NPM version 0.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on @n8n/ai-utilities and may be impacted: - @n8n/agents 0.17.0 - @n8n/ai-node-sdk 0.22.0 - @n8n/ai-workflow-builder 1.32.0 - @n8n/create-node 0.40.0 - @n8n/instance-ai...

@n8n/ai-workflow-builder (0.30.0), @n8n/task-runner (1.56.0) +2 more potentially affected by CVE-2025-65964 via @n8n/config (1.62.0)

@n8n/config NPM version 1.62.0 is affected by a known vulnerability. The following packages have a transitive dependency on @n8n/config and may be impacted: - @n8n/ai-workflow-builder 0.30.0 - @n8n/task-runner 1.56.0 - n8n-core =1.119.0, =1.119.1 - n8n-node-dev 1.118.0 Source cves: CVE-2025-65964...