{"id":"EUVD-2026-38462","enisaUuid":"dc52cfe8-a8f3-314c-8493-b429451e6e5e","description":"n8n is an open source workflow automation platform. Prior to 2.24.0, the Compression node\u0027s Decompress operation expanded attacker-controlled archives into memory without enforcing limits on decompressed output size. An unauthenticated attacker could send a small compressed archive to a public webhook workflow using this node, causing the n8n process to terminate due to memory exhaustion and disrupting all workflows in the same instance. This vulnerability is fixed in 2.24.0.","datePublished":"Jun 23, 2026, 3:33:52 PM","dateUpdated":"Jun 24, 2026, 1:56:50 PM","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-jqpw-qww5-cj4c\n","aliases":"CVE-2026-54314\nGHSA-jqpw-qww5-cj4c\n","assigner":"GitHub_M","epss":0.55,"enisaIdProduct":[{"id":"d10ec222-74a8-305e-8c50-70169d39e889","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"\u003c 2.24.0"}],"enisaIdVendor":[{"id":"1f23cc67-55d9-327c-87f0-01801cdbfde1","vendor":{"name":"n8n-io"}}],"enisaIdVulnerability":[{"id":"9978ea7a-a1f6-3633-ac76-0db77c03636a","vulnerability":{"id":"CVE-2026-54314","description":"n8n is an open source workflow automation platform. Prior to 2.24.0, the Compression node\u0027s Decompress operation expanded attacker-controlled archives into memory without enforcing limits on decompressed output size. An unauthenticated attacker could send a small compressed archive to a public webhook workflow using this node, causing the n8n process to terminate due to memory exhaustion and disrupting all workflows in the same instance. This vulnerability is fixed in 2.24.0.","datePublished":"Jun 23, 2026, 3:33:52 PM","dateUpdated":"Jun 24, 2026, 1:56:50 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-jqpw-qww5-cj4c\n","enisa_id":"EUVD-2026-38462\n","assigner":"GitHub_M","epss":0.55,"dataProcessed":"Nov 1, 2026, 7:17:24 AM","vulnerabilityProduct":[{"id":"aeaf0dbb-445a-3146-9dc6-60e6168d7283","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"\u003c 2.24.0"}],"vulnerabilityVendor":[{"id":"27081913-5892-3c50-88c4-d3e2786ce517","vendor":{"name":"n8n-io"}}]}},{"id":"a66a2e8d-d669-3683-b9be-35995a61fe50","vulnerability":{"id":"GHSA-jqpw-qww5-cj4c","description":"n8n: Denial of Service via ZIP decompression in webhook workflow","datePublished":"Jun 16, 2026, 11:01:51 PM","dateUpdated":"Jul 20, 2026, 1:39:57 PM","baseScore":0.0,"references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-jqpw-qww5-cj4c\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54314\nhttps://github.com/n8n-io/n8n\n","enisa_id":"EUVD-2026-38462\n","aliases":"GHSA-jqpw-qww5-cj4c\nCVE-2026-54314\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"cf27303b-d364-3c88-8798-0e5b732f1a36","advisory":{"id":"NCSC-2026-0212","description":"Kwetsbaarheden verholpen in n8n workflow automation platform","datePublished":"Jun 29, 2026, 8:02:42 AM","dateUpdated":"Jun 29, 2026, 8:02:42 AM","baseScore":0.0,"references":"","aliases":"CVE-2026-54301\nCVE-2026-54302\nCVE-2026-54304\nCVE-2026-54305\nCVE-2026-54306\nCVE-2026-54307\nCVE-2026-54308\nCVE-2026-54309\nCVE-2026-54310\nCVE-2026-54311\nCVE-2026-54312\nCVE-2026-54313\nCVE-2026-54314\nCVE-2026-54303\n","source":{"id":19,"name":"csaf_ncscnl"},"advisoryProduct":[{"id":"9b0181f2-7f6b-3f30-80cf-cc01cf736196","product":{"name":"n8n","vendor":{"name":"n8n-io"}}}]}}]}