---
id: GHSA-xwx6-jjhv-84p8
title: >-
  n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide
  Denial of Service
summary: >-
  n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide
  Denial of Service
severity: high
cwe:
  - CWE-1321
vendor: n8n
product: n8n
ecosystem: npm
affected:
  - n8n < 1.123.67
  - 'n8n >= 2.32.0, < 2.32.1'
  - 'n8n >= 2.0.0-rc.0, < 2.31.5'
patched:
  - n8n 1.123.67
  - n8n 2.32.1
  - n8n 2.31.5
published: '2026-07-22'
updated: '2026-07-22'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-xwx6-jjhv-84p8'
references:
  - url: 'https://github.com/n8n-io/n8n/security/advisories/GHSA-xwx6-jjhv-84p8'
  - url: >-
      https://github.com/n8n-io/n8n/commit/f69dfc6dd2178a14ea1624d2e1d403c2e755042f
  - url: 'https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.67'
  - url: 'https://github.com/n8n-io/n8n/releases/tag/n8n@2.31.5'
  - url: 'https://github.com/n8n-io/n8n/releases/tag/n8n@2.32.1'
  - url: 'https://github.com/advisories/GHSA-xwx6-jjhv-84p8'
tags:
  - ghsa
  - npm
ingestedAt: '2026-07-22T23:07:32.869Z'
---

## Overview

## Impact

The Edit Fields (Set) node assigned output fields through a dot-notation path setter without restricting the field name, so an authenticated user could name a field after an inherited built-in method path and corrupt a shared global in the main Node.js process. Because that global was used on the request-authentication path, the instance then failed every authenticated request, causing a instance-wide denial of service for all users until the process was restarted.

## Patches

The issue has been fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

## Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n instance access to fully trusted users only.
- Disable or restrict workflow creation and execution permissions for untrusted users.
- Monitor for unexpected process-wide HTTP 500 errors and restart the process promptly if they occur.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

## Affected packages

- `n8n < 1.123.67`
- `n8n >= 2.32.0, < 2.32.1`
- `n8n >= 2.0.0-rc.0, < 2.31.5`

## Remediation

Upgrade to a patched release:

- `n8n 1.123.67`
- `n8n 2.32.1`
- `n8n 2.31.5`