🚨High - n8n Prototype Pollution Denial of Service via Edit Fields Node (CVE-2026-72749) n8n's Edit Fields (Set) node assigns output fields using a dot-notation path setter without restricting the field name. An authenticated user can name a field after an inherited built-in method path, polluting a prototype and corrupting a shared global in the main Node.js process. Because that global sits on the request-authentication path, the instance then fails every authenticated request, an instance-wide denial of service for all users until the process is restarted. There's no code execution or data exposure, and it requires an authenticated user, so the main risk is shared or multi-user n8n instances. CVSS 7.1. 👉Upgrade n8n to 1.123.67, 2.31.5, or 2.32.1 depending on your release line.
Post summary
The post discloses CVE‑2026‑72749, a prototype‑pollution induced denial‑of‑service in n8n affecting authenticated users, and provides specific patch releases to remediate it.