n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-86078 · CVE overview and exploitation status

EUVD-2026-74278

GHSA-679f-58pq-4v2c

cve-program · CVE-2026-86078

• https://github.com/n8n-io/n8n/security/advisories/GHSA-679f-58pq-4v2c
• https://github.com/n8n-io/n8n/releases/tag/[email protected]
• https://github.com/n8n-io/n8n/releases/tag/[email protected]

euvd · EUVD-2026-74278

• https://github.com/n8n-io/n8n/security/advisories/GHSA-679f-58pq-4v2c
• https://github.com/n8n-io/n8n/releases/tag/[email protected]
• https://github.com/n8n-io/n8n/releases/tag/[email protected]

nvd · CVE-2026-86078

• https://github.com/n8n-io/n8n/releases/tag/[email protected]
• https://github.com/n8n-io/n8n/releases/tag/[email protected]
• https://github.com/n8n-io/n8n/security/advisories/GHSA-679f-58pq-4v2c

osv · GHSA-679f-58pq-4v2c

• https://github.com/n8n-io/n8n/security/advisories/GHSA-679f-58pq-4v2c
• https://nvd.nist.gov/vuln/detail/CVE-2026-86078
• https://github.com/n8n-io/n8n
• https://github.com/n8n-io/n8n/releases/tag/[email protected]
• https://github.com/n8n-io/n8n/releases/tag/[email protected]

• n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI workflow summary used node names and connection keys from stored workflows as ordinary object keys. A workflow submitted through the REST API co… · Advisory content revised · 15 Nov 2026