CVE-2026-77082

CVE-2026-77082 is a ReDoS in n8n's Filter and Switch nodes where user-supplied regex patterns can block worker threads. The patch adds a timeout, which is correct but incomplete — it treats the symptom, not the architectural assumption that user-supplied regex is safe to compile synchronously in a shared worker context. What makes this worth your attention isn't the individual vulnerability — it's what it reveals about n8n's threat model in multi-tenant or shared-team deployments. The CVSS 5.3 score assumes a single workflow author affecting only their own execution. If multiple teams share workers, one naive regex from one author freezes every workflow waiting on that thread. That's a blast radius the CVSS model doesn't capture, and it changes the severity from nuisance to service degradation for unrelated tenants. The supply chain dimension compounds this. Workflows are shared artifacts — passed between teams, stored in internal registries, pulled from community templates. When the attack vector lives inside a workflow file that an ignorant or malicious author distributes, the 'attacker' and 'victim' are the same person running someone else's payload. That's a qualitatively different threat model than traditional injection flaws, and it means the vulnerability isn't just about what you type — it's about what you import. The fix addresses this specific regex path. It does not address the broader pattern: n8n's expression language, template interpolation, and credential references all accept user-supplied content with the same implicit trust model. The historical record shows this pattern recurring across every workflow automation platform that has exposed powerful primitives to non-specialist users — Kantu (2019), Zapier (2020), Power Automate (2021), now n8n (2026). Each gets a CVE, a patch, and a post-mortem. The pattern resurfaces in the next platform serving the next wave of 'citizen automators' who have never read the previous post-mortems. Your actions: verify the timeout patch is applied; if you run shared workers with untrusted workflow authors, treat this as a higher-severity denial-of-service risk than the CVSS suggests; audit your other user-supplied input paths (expression language, templates) for equivalent complexity risks — the next CVE in this lineage is likely already gestating in one of them.

Reviewed through automated stages and approved by a human before publication.