n8n: Prototype Pollution in Workflow History Compaction Causes Denial of Service

Impact

A workflow's connections object accepts arbitrary keys, and the routine that diffs two sets of connections used those keys directly as object members. A low-privileged user can save a workflow whose connections carry a specially named key; the periodic workflow-history compaction task then processes it and alters the behaviour of built-in objects for the whole process. The instance then answers logins and writes with server errors.

Patches

This issue has been fixed in n8n version 2.42.1, and 2.41.4. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Restrict n8n instance access to fully trusted users only.
• Disable workflow history by setting N8N_WORKFLOW_HISTORY_ENABLED=false if the feature is not required.
• Audit existing workflows for nodes with reserved JavaScript property names such as __proto__, constructor, or prototype in their connections and remove or rename them.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.