Read/Write Files Node Glob Pattern Causes Unbounded Event-Loop Block
Résumé
Impact
The Read/Write Files from Disk node evaluated the File(s) Selector glob pattern on the main event loop with no time limit. A selector with many wildcards compiles to a regular expression with exponential backtracking. A member who can create and run workflows can submit such a pattern a...
Résumé IA
Rédigé par une IA externe ; il peut contenir des erreurs. Vérifiez la description d'origine et les références ci-dessous avant d'agir.
n8nのRead/Write Files from Diskノードで、File(s) Selectorに多数のワイルドカードを含むグロブパターンを入力すると、処理が時間制限なくメインのイベントループを占有します。これによりUI、API、Webhookが応答しなくなり、プロセスを再起動するまで復旧しません。修正版はn8n 1.123.85、2.43.5、2.44.1以降です。すぐに更新できない場合は、信頼できるユーザーのみに利用を限定し、不要ならn8n-nodes-base.readWriteFileをNODES_EXCLUDEで無効化してください。
Paquets affectés
| Écosystème | Paquet | Concernées | Corrigé |
|---|---|---|---|
| npm | n8n |
< 1.123.85 |
>= 1.123.85 |
| npm | n8n |
< 2.44.1 |
>= 2.44.1 |
| npm | n8n |
< 2.43.5 |
>= 2.43.5 |
Description d'origine La description telle que publiée par la source (souvent en anglais).
Impact
The Read/Write Files from Disk node evaluated the File(s) Selector glob pattern on the main event loop with no time limit. A selector with many wildcards compiles to a regular expression with exponential backtracking. A member who can create and run workflows can submit such a pattern and block the n8n process, so the UI, API, webhooks and health checks stop responding until the process is restarted.
Patches
The issue has been fixed in n8n versions 1.123.85, 2.44.1, and 2.43.5. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n instance access to fully trusted users only.
- Disable the Read/Write Files node by adding
n8n-nodes-base.readWriteFileto theNODES_EXCLUDEenvironment variable if it is not required. - Audit existing workflows for Read/Write Files nodes with unusual File(s) Selector values and remove or correct them.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Source: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
Références
- GITHUB_REPO_ADVISORY n8n-io/n8n