n8n Prototype Pollution Vulnerability (CVE-2026-54312) — High Severity

Understanding the n8n Prototype Pollution Vulnerability

A significant security flaw has been identified in n8n, an open-source platform popular for automating workflows. This vulnerability, tracked as CVE-2026-54312, is a type of attack called “prototype pollution.” It allows an attacker to manipulate the core properties of JavaScript objects within the n8n server, leading to severe disruptions.

Specifically, an authenticated user who has the ability to create or change workflows could exploit this by using the Microsoft SQL node. By providing a specially crafted input as the “table” parameter, they could inject malicious properties into the fundamental JavaScript `Object.prototype`. When this happens, it affects the entire n8n server process, causing various application-wide validation issues and effectively making the n8n instance completely unusable until it is manually restarted. This makes it a critical issue for any organization relying on n8n for their operations.

CVE Details

• Product: n8n workflow automation platform
• Published Date: June 23, 2026
• Severity: HIGH
• Status: Analyzed

Affected Products

This vulnerability impacts versions of n8n prior to 2.24.0. If you are running any version older than 2.24.0, your n8n instance is at risk.

Current Status

The vulnerability has been thoroughly analyzed, and a fix is available. Users are strongly encouraged to take immediate action to protect their systems.

Severity Level

This vulnerability is rated as HIGH severity. The ability for an authenticated user to render an entire n8n instance non-functional highlights the serious nature of this flaw. While it requires authenticated access, the widespread impact on availability makes it a critical concern for system administrators and developers.

Possible Solutions

The good news is that n8n has already released a patch to address this issue:

• Upgrade to n8n version 2.24.0 or later: This is the primary and most effective solution. Upgrading your n8n instance to version 2.24.0 or any subsequent release will fix the prototype pollution vulnerability.

Temporary Mitigations (if immediate upgrade is not possible):

If you cannot upgrade your n8n instance right away, consider these temporary steps. Please remember these are not full fixes and should only be used short-term:

• Restrict Workflow Permissions: Limit who can create or modify workflows to only the most trusted administrators. This reduces the attack surface by limiting the number of potential attackers.
• Disable the Microsoft SQL Node: You can temporarily disable the vulnerable Microsoft SQL node by adding n8n-nodes-base.microsoftSql to the NODES_EXCLUDE environment variable in your n8n configuration. This prevents the specific attack vector from being exploited.

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-x6p3-m6h9-fx7r