n8n, a popular open-source platform for workflow automation, has a significant security vulnerability that could disrupt its operations. This flaw, identified as CVE-2026-54314, affects the Compression node within the platform. An attacker could exploit this to completely shut down your n8n instance, causing a “Denial of Service.”
In simple terms, if you use the Compression node with its “Decompress” operation in a workflow accessible via a public webhook, an attacker could send a specially crafted, small compressed file. This file, when processed, would try to expand into an excessively large amount of memory. Since n8n’s Compression node did not have proper limits on how much memory it could use for decompression, this would quickly exhaust the system’s resources, forcing the n8n process to crash. This type of attack means that all workflows running on that n8n instance would stop working, severely impacting any automated tasks or services you rely on.
CVE Details
- Product: n8n
- Published: June 23, 2026
- Severity: High
- Status: Analyzed
Affected Products
The vulnerability impacts all n8n versions prior to 2.24.0. If your n8n instance is running any version older than 2.24.0, it is susceptible to this Denial of Service attack.
Current Status
The vulnerability has been officially “Analyzed,” meaning its details are understood and a fix has been released by the vendor.
Severity Level
This vulnerability is rated as High severity with a CVSS score of 7.5 (CVSS 3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). The GitHub advisory also indicates a “Moderate” severity with a CVSS 4.0 score of 6.3. While this vulnerability does not typically lead to data theft or unauthorized access, its ability to completely halt your n8n services makes it a serious concern. Service disruption can lead to significant operational issues and financial losses for organizations relying on n8n for critical automated tasks.
Possible Solutions
The most effective way to protect your n8n instance from CVE-2026-54314 is to update to a patched version immediately. The issue has been officially fixed in n8n version 2.24.0. Users should upgrade to this version or any later release to apply the necessary security patches.
The fix introduces new configurable limits for the Compression node to prevent such memory exhaustion attacks. These new settings are N8N_COMPRESSION_NODE_MAX_DECOMPRESSED_SIZE_BYTES (for controlling maximum decompressed output size) and N8N_COMPRESSION_NODE_MAX_ZIP_ENTRIES (for limiting the number of entries in a ZIP archive).
Temporary Workarounds:
If an immediate upgrade is not feasible, consider these temporary mitigation steps:
- Disable the Compression node: You can disable the problematic Compression node by adding
n8n-nodes-base.compressionto yourNODES_EXCLUDEenvironment variable. This will prevent workflows from using the vulnerable node. - Restrict public webhook access: For workflows that handle archive file uploads, ensure that these endpoints are only accessible to authenticated users. This limits the ability of unauthenticated attackers to exploit the vulnerability.
Please note that these workarounds are temporary and do not fully address the underlying vulnerability. Prioritize upgrading to version 2.24.0 or higher as soon as possible for comprehensive protection.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-jqpw-qww5-cj4c
