n8nでワークフロー履歴の処理を通じてサービス停止が起きる脆弱性
Summary
低い権限のユーザーが特殊なキーを含むワークフローを保存すると、履歴の整理処理でプロトタイプ汚染が発生し、サービス拒否の状態になります。影響を受けるのはn8nの特定の版で、修正版は2.41.4と2.42.1です。修正版へのアップグレードを推奨します。すぐに更新できない場合は、利用者を信頼できる人だけに絞り、ワークフロー履歴を無効にしてください。
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
低い権限のユーザーが特殊なキーを含むワークフローを保存すると、履歴の整理処理でプロトタイプ汚染が発生し、サービス拒否の状態になります。影響を受けるのはn8nの特定の版で、修正版は2.41.4と2.42.1です。修正版へのアップグレードを推奨します。すぐに更新できない場合は、利用者を信頼できる人だけに絞り、ワークフロー履歴を無効にしてください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| npm | n8n |
< 2.41.4 |
>= 2.41.4 |
Original description The description as published by the source.
Impact
A workflow's connections object accepts arbitrary keys, and the routine that diffs two sets of connections used those keys directly as object members. A low-privileged user can save a workflow whose connections carry a specially named key; the periodic workflow-history compaction task then processes it and alters the behaviour of built-in objects for the whole process. The instance then answers logins and writes with server errors.
Patches
This issue has been fixed in n8n version 2.42.1, and 2.41.4. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n instance access to fully trusted users only.
- Disable workflow history by setting
N8N_WORKFLOW_HISTORY_ENABLED=falseif the feature is not required. - Audit existing workflows for nodes with reserved JavaScript property names such as
__proto__,constructor, orprototypein their connections and remove or rename them.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Source: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
References
- GITHUB_REPO_ADVISORY n8n-io/n8n