https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T00:32:29.830513+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-86081 CVE-2026-86081 — n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path 2026-10-07T00:32:29.832082+00:00

Affected: n8n-io n8n

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node clone operation matched an attacker-controlled destination path against the default N8N_BLOCK_FILE_PATTERNS regular expression. The pattern ^(./).git(/.)$ allowed catastrophic backtracking and ran synchronously in the main n8n process. An authenticated workflow editor could therefore freeze the instance with one workflow execution; the affected default is declared in packages/@n8n/config/src/configs/security.config.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.