n8n: Read/Write Files Node Glob Pattern Causes Unbounded Event-Loop Block

Impact

The Read/Write Files from Disk node evaluated the File(s) Selector glob pattern on the main event loop with no time limit. A selector with many wildcards compiles to a regular expression with exponential backtracking. A member who can create and run workflows can submit such a pattern and block the n8n process, so the UI, API, webhooks and health checks stop responding until the process is restarted.

Patches

The issue has been fixed in n8n versions 1.123.85, 2.44.1, and 2.43.5. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Restrict n8n instance access to fully trusted users only.
• Disable the Read/Write Files node by adding n8n-nodes-base.readWriteFile to the NODES_EXCLUDE environment variable if it is not required.
• Audit existing workflows for Read/Write Files nodes with unusual File(s) Selector values and remove or correct them.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.