n8n Vulnerable to Denial of Service via Malformed Binary Data Requests
Medium4.9CVE-2025-49595 · Published Jul 3, 2025
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| n8n npm | < 1.99.0 | 1.99.0 |
Details and references
## Summary Denial of Service vulnerability in `/rest/binary-data` endpoint when processing empty filesystem URIs (`filesystem://` or `filesystem-v2://`). ### Impact This is a Denial of Service (DoS) vulnerability that allows authenticated attackers to cause service unavailability through malformed filesystem URI requests. The vulnerability affects: - The `/rest/binary-data` endpoint - n8n.cloud instances (confirmed HTTP/2 524 timeout responses) Attackers can exploit this by sending GET requests with empty filesystem URIs (`filesystem://` or `filesystem-v2://`) to the `/rest/binary-data` endpoint, causing resource exhaustion and service disruption. ### Patches The issue has been patched in [1.99.0](https://github.com/n8n-io/n8n/releases/tag/n8n%401.99.0). All users should upgrade to this version or later. The fix introduces strict checking of URI patterns. Patch commit: https://github.com/n8n-io/n8n/pull/16229
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-400
- Also known as
- CVE-2025-49595
More n8n advisories
All n8n| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 32025 | n8n is vulnerable to Improper Authorization through its `/stop` endpoint CVE-2025-52554Medium4.3fixed in 1.99.1 | Medium4.3 | 1.99.1 |
| Jun 272025 | n8n allows open redirects via the /signin endpoint CVE-2025-49592Medium4.6fixed in 1.98.0 | Medium4.6 | 1.98.0 |
| Aug 192025 | Stored XSS in n8n Form Trigger allows Account Takeover via injected iframe and video/source CVE-2025-52478High8.7fixed in 1.98.2 | High8.7 | 1.98.2 |
| Aug 202025 | n8n symlink traversal vulnerability in "Read/Write File" node allows access to restricted files CVE-2025-57749Medium6.5fixed in 1.106.0 | Medium6.5 | 1.106.0 |
| Apr 282025 | n8n Vulnerable to Stored XSS through Attachments View Endpoint CVE-2025-46343Medium5.0fixed in 1.90.0 | Medium5.0 | 1.90.0 |
| Sep 152025 | Stored XSS in n8n LangChain Chat Trigger Node via initialMessages Parameter CVE-2025-58177Medium4.1fixed in 1.107.0 | Medium4.1 | 1.107.0 |