{"id":"CVE-2026-72749","title":"n8n before 1.123.67 Prototype Pollution via Edit Fields","summary":"n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticat…","severity":"high","cvss":7.1,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-1321"],"vendor":"n8n-io","product":"n8n","affected":["n8n < 1.123.67","n8n >= 2.32.0 < 2.32.1","n8n >= 2.0.0-rc.0 < 2.31.5"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-08-11T17:41:04.589878Z"},"published":"2026-08-11","updated":"2026-10-29","sourceUpdated":"2026-10-29T21:16:34.851Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72749","references":[{"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-xwx6-jjhv-84p8","label":"GitHub Security Advisory (GHSA-xwx6-jjhv-84p8)"},{"url":"https://www.vulncheck.com/advisories/n8n-before-prototype-pollution-via-edit-fields","label":"VulnCheck Advisory: n8n before 1.123.67 Prototype Pollution via Edit Fields"}],"tags":["cve.org"],"epss":0.00573,"epssPercentile":0.47341,"ingestedAt":"2026-11-03T08:39:35.586Z","slug":"CVE-2026-72749","body":"## Overview\n\nn8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated user to name a field after an inherited built-in method path and corrupt a shared global in the main Node.js process. Because that global is used on the request-authentication path, the instance then fails every authenticated request, causing an instance-wide denial of service for all users until the process is restarted.\n\n## Affected\n\n- `n8n < 1.123.67`\n- `n8n >= 2.32.0 < 2.32.1`\n- `n8n >= 2.0.0-rc.0 < 2.31.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}