n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service
MediumCVE-2026-86078 · Published Sep 10, 2026
## Impact The Instance AI workflow summary built its result with get-or-create-then-nested-write idioms keyed by node names and connection keys taken from the stored workflow. Those are arbitrary strings: the restricted-name guard n8n shows in the editor is client-side and is bypassed by posting the workflow to the REST API directly. So a reserved key such as `__proto__` resolved up the prototype chain instead of creating an own key, and the write landed on `Object.prototype` in the main n8n process, affecting every later request. The patch builds the summary with null-prototype accumulators and validates the keys it accepts, so reserved names cannot reach the prototype chain. ## Patches The issue has been fixed in n8n versions 2.37.7 and 2.38.2. Users should upgrade to one of these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict n8n instance access to fully trusted users only. - Remove or leave unconfigured the `N8N_INSTANCE_AI_MODEL*` environment variables to prevent the Instance AI module from reaching the vulnerable code path. - Restart ...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| n8n npm | >= 2.38.0, < 2.38.2 | 2.38.2 |
| < 2.37.7 | 2.37.7 |
Details and references
## Impact The Instance AI workflow summary built its result with get-or-create-then-nested-write idioms keyed by node names and connection keys taken from the stored workflow. Those are arbitrary strings: the restricted-name guard n8n shows in the editor is client-side and is bypassed by posting the workflow to the REST API directly. So a reserved key such as `__proto__` resolved up the prototype chain instead of creating an own key, and the write landed on `Object.prototype` in the main n8n process, affecting every later request. The patch builds the summary with null-prototype accumulators and validates the keys it accepts, so reserved names cannot reach the prototype chain. ## Patches The issue has been fixed in n8n versions 2.37.7 and 2.38.2. Users should upgrade to one of these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict n8n instance access to fully trusted users only. - Remove or leave unconfigured the `N8N_INSTANCE_AI_MODEL*` environment variables to prevent the Instance AI module from reaching the vulnerable code path. - Restart the n8n process to clear any in-memory prototype pollution if an attack is suspected. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-1321
- Also known as
- CVE-2026-86078
More n8n advisories
All n8n| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 10 | n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution MediumSep 10 | Medium | 2.37.7+1 more |
| Sep 10 | n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched ContentMediumSep 10 | Medium | 2.37.7+1 more |
| Sep 10 | n8n: path traversalMediumSep 10 | Medium | 1.123.76+2 more |
| Sep 10 | n8n: missing authorizationMediumSep 10 | Medium | 2.37.7+1 more |
| Sep 10 | n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership CheckMediumSep 10 | Medium | 1.123.76+2 more |
| Sep 10 | n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid SessionsMediumSep 10 | Medium | 1.123.76+2 more |