n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-86081 · CVE overview and exploitation status

EUVD-2026-74275

GHSA-j535-v25q-vx3q

cve-program · CVE-2026-86081

• https://github.com/n8n-io/n8n/security/advisories/GHSA-j535-v25q-vx3q
• https://github.com/n8n-io/n8n/releases/tag/[email protected]
• https://github.com/n8n-io/n8n/releases/tag/[email protected]
• https://github.com/n8n-io/n8n/releases/tag/[email protected]

euvd · EUVD-2026-74275

• https://github.com/n8n-io/n8n/security/advisories/GHSA-j535-v25q-vx3q
• https://github.com/n8n-io/n8n/releases/tag/[email protected]
• https://github.com/n8n-io/n8n/releases/tag/[email protected]
• https://github.com/n8n-io/n8n/releases/tag/[email protected]

nvd · CVE-2026-86081

• https://github.com/n8n-io/n8n/releases/tag/[email protected]
• https://github.com/n8n-io/n8n/releases/tag/[email protected]
• https://github.com/n8n-io/n8n/releases/tag/[email protected]
• https://github.com/n8n-io/n8n/security/advisories/GHSA-j535-v25q-vx3q

osv · GHSA-j535-v25q-vx3q

• https://github.com/n8n-io/n8n/security/advisories/GHSA-j535-v25q-vx3q
• https://nvd.nist.gov/vuln/detail/CVE-2026-86081
• https://github.com/n8n-io/n8n
• https://github.com/n8n-io/n8n/releases/tag/[email protected]
• https://github.com/n8n-io/n8n/releases/tag/[email protected]
• https://github.com/n8n-io/n8n/releases/tag/[email protected]

• n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node clone operation matched an attacker-controlled destination path against the default N8N_BLOCK_FILE_PATTERNS regular expression. The patt… · Advisory content revised · 15 Nov 2026