{"schema":"threatline.record/2","record":{"id":"GHSA-fvv4-gmv9-xqf5","aliases":["GHSA-fvv4-gmv9-xqf5"],"summary":"Prototype Pollution in Workflow History Compaction Causes Denial of Service ","details":"## Impact\n\nA workflow's connections object accepts arbitrary keys, and the routine that diffs two sets of connections used those keys directly as object members. A low-privileged user can save a workflow whose connections carry a specially named key; the periodic workflow-history compaction task then processes it and alters the behaviour of built-in objects for the whole process. The instance then answers logins and writes with server errors.\n\n## Patches\n\nThis issue has been fixed in n8n version 2.42.1, and 2.41.4. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\n\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Restrict n8n instance access to fully trusted users only.\n- Disable workflow history by setting `N8N_WORKFLOW_HISTORY_ENABLED=false` if the feature is not required.\n- Audit existing workflows for nodes with reserved JavaScript property names such as `__proto__`, `constructor`, or `prototype` in their connections and remove or rename them.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","categories":["Frameworks"],"product":"n8n","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-fvv4-gmv9-xqf5","source_modified_at":"2026-10-14T09:34:48Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 2.41.4"}],"fixed_versions":[],"cvss":7.1,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-14T09:34:48Z","modified_at":"2026-10-14T09:34:48Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-fvv4-gmv9-xqf5","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-14T09:34:48Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-14T09:34:48Z","content_hash":"614b6a4b2ff1458f5a6016ee2889c355cc87b813504e68de5800126cc58ca8c8"}}