VDB
CVE-2026-54314
CVE-2026-54314
PUBLISHED
CVSS 6.3 MEDIUM
Reported by GitHub_M · Published June 23, 2026
n8n is an open source workflow automation platform. Prior to 2.24.0, the Compression node's Decompress operation expanded attacker-controlled archives into memory without enforcing limits on decompressed output size. An unauthenticated attacker could send a small compressed archive to a public webhook workflow using this node, causing the n8n process to terminate due to memory exhaustion and disrupting all workflows in the same instance. This vulnerability is fixed in 2.24.0.
Risk Scores
CVSS 4.0
6.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n8n-io | n8n | < 2.24.0 |
| npm | n8n | 0 |
| n8n-io | n8n | < 2.24.0, < 2.24.0, < 2.24.0 |
Timeline
- Jun 16, 2026 CVE Published
- Jun 24, 2026 EPSS Score
- Jun 24, 2026 Coalition ESS Score
- Jun 24, 2026 Security Advisory