CVE-2026-86075: Allocation of Resources Without Limits or Throttling

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirecturis but accepted arbitrarily large clientname and granttypes values. An unauthenticated remote caller could repeatedly persist oversized values in...

PT-2026-88506

Impact The OAuth Dynamic Client Registration endpoints validated field sizes only for redirect uris, leaving client name and grant types bounded by presence checks alone. An unauthenticated remote caller could submit arbitrarily large values in either field and have them persisted to the database...