CVE-2026-72749: n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The …
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated user to name a field after an inherited built-in method path and corrupt a shared global in the main Node.js process. Because that global is used on the request-authentication path, the instance then fails every authenticated request, causing an instance-wide denial of service for all users until the process is restarted.
- Published by source
- 2026-08-11
- First seen by Reality Radar
- 2026-10-23
- Last verified
- 2026-10-23
Affected
- Manufacturer
- n8n
- Products
- n8n
- Versions
- <1.123.67 <2.31.5 2.32.0
- CPE
- cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*
cpe:2.3:a:n8n:n8n:2.32.0:*:*:*:*:node.js:*:*
Whether your exact unit is affected depends on the model, serial number and region in the official notice.
What the official notice says
Risk: CVSS 7.1
Is this affecting you?
Add what you own or use and Reality Radar will tell you when official changes match it — with evidence and next steps.
Sources
- NIST National Vulnerability Database Tier A · official published 2026-08-11
Evidence ledger
Every piece of evidence we store is appended to a public hash chain, so later edits are detectable. Anyone can re-verify it.
| Entry | Kind | Observed | Evidence hash | Entry hash |
|---|---|---|---|---|
| #1296 | new | 2026-10-23 | ccaa8b1cab64…52cbc8 | 596f2af68d92…091115 |
Chain head: #1479 ad3417dbc128…777bd4