CVE-2026-54314 PUBLISHED

n8n: Denial of Service via ZIP decompression in webhook workflow

Assigner: GitHub_M
Reserved: 12.06.2026 Published: 23.06.2026 Updated: 23.06.2026

n8n is an open source workflow automation platform. Prior to 2.24.0, the Compression node's Decompress operation expanded attacker-controlled archives into memory without enforcing limits on decompressed output size. An unauthenticated attacker could send a small compressed archive to a public webhook workflow using this node, causing the n8n process to terminate due to memory exhaustion and disrupting all workflows in the same instance. This vulnerability is fixed in 2.24.0.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS Score: 6.3

Product Status

Vendor n8n-io
Product n8n
Versions
  • Version < 2.24.0 is affected

References

Problem Types

  • CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) CWE