n8nのファイル読み書きノードで細工されたグロブパターンによりサービスが停止する
Summary
n8nのRead/Write Files from Diskノードで、File(s) Selectorに多数のワイルドカードを含むグロブパターンを入力すると、処理が時間制限なくメインのイベントループを占有します。これによりUI、API、Webhookが応答しなくなり、プロセスを再起動するまで復旧しません。修正版はn8n 1.123.85、2.43.5、2.44.1以降です。すぐに更新できない場合は、信頼できるユーザーのみに利用を限定し、不要ならn8n-nodes-base.readWriteFileをNODES_EXCLUDEで無効化してください。
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
n8nのRead/Write Files from Diskノードで、File(s) Selectorに多数のワイルドカードを含むグロブパターンを入力すると、処理が時間制限なくメインのイベントループを占有します。これによりUI、API、Webhookが応答しなくなり、プロセスを再起動するまで復旧しません。修正版はn8n 1.123.85、2.43.5、2.44.1以降です。すぐに更新できない場合は、信頼できるユーザーのみに利用を限定し、不要ならn8n-nodes-base.readWriteFileをNODES_EXCLUDEで無効化してください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| npm | n8n |
< 1.123.85 |
>= 1.123.85 |
| npm | n8n |
< 2.44.1 |
>= 2.44.1 |
| npm | n8n |
< 2.43.5 |
>= 2.43.5 |
Original description The description as published by the source.
Impact
The Read/Write Files from Disk node evaluated the File(s) Selector glob pattern on the main event loop with no time limit. A selector with many wildcards compiles to a regular expression with exponential backtracking. A member who can create and run workflows can submit such a pattern and block the n8n process, so the UI, API, webhooks and health checks stop responding until the process is restarted.
Patches
The issue has been fixed in n8n versions 1.123.85, 2.44.1, and 2.43.5. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n instance access to fully trusted users only.
- Disable the Read/Write Files node by adding
n8n-nodes-base.readWriteFileto theNODES_EXCLUDEenvironment variable if it is not required. - Audit existing workflows for Read/Write Files nodes with unusual File(s) Selector values and remove or correct them.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Source: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
References
- GITHUB_REPO_ADVISORY n8n-io/n8n