ghsa-pr9r-gxgp-9rm8
Vulnerability from github
Published
2025-07-03 14:06
Modified
2025-07-03 16:20
Severity ?
4.9 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Summary
n8n Vulnerable to Denial of Service via Malformed Binary Data Requests
Details

Summary

Denial of Service vulnerability in /rest/binary-data endpoint when processing empty filesystem URIs (filesystem:// or filesystem-v2://).

Impact

This is a Denial of Service (DoS) vulnerability that allows authenticated attackers to cause service unavailability through malformed filesystem URI requests. The vulnerability affects:

  • The /rest/binary-data endpoint
  • n8n.cloud instances (confirmed HTTP/2 524 timeout responses)

Attackers can exploit this by sending GET requests with empty filesystem URIs (filesystem:// or filesystem-v2://) to the /rest/binary-data endpoint, causing resource exhaustion and service disruption.

Patches

The issue has been patched in 1.99.0. All users should upgrade to this version or later.

The fix introduces strict checking of URI patterns.

Patch commit: https://github.com/n8n-io/n8n/pull/16229

Show details on source website

To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "n8n"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.99.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-49595"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-07-03T14:06:01Z",
    "nvd_published_at": "2025-07-03T13:15:28Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\nDenial of Service vulnerability in `/rest/binary-data` endpoint when processing empty filesystem URIs (`filesystem://` or `filesystem-v2://`).\n\n### Impact\nThis is a Denial of Service (DoS) vulnerability that allows authenticated attackers to cause service unavailability through malformed filesystem URI requests. The vulnerability affects:\n\n- The `/rest/binary-data` endpoint\n- n8n.cloud instances (confirmed HTTP/2 524 timeout responses)\n\nAttackers can exploit this by sending GET requests with empty filesystem URIs (`filesystem://` or `filesystem-v2://`) to the `/rest/binary-data` endpoint, causing resource exhaustion and service disruption.\n\n### Patches\n\nThe issue has been patched in [1.99.0](https://github.com/n8n-io/n8n/releases/tag/n8n%401.99.0).\nAll users should upgrade to this version or later.\n\nThe fix introduces strict checking of URI patterns.\n\nPatch commit: https://github.com/n8n-io/n8n/pull/16229",
  "id": "GHSA-pr9r-gxgp-9rm8",
  "modified": "2025-07-03T16:20:44Z",
  "published": "2025-07-03T14:06:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-pr9r-gxgp-9rm8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49595"
    },
    {
      "type": "WEB",
      "url": "https://github.com/n8n-io/n8n/pull/16229"
    },
    {
      "type": "WEB",
      "url": "https://github.com/n8n-io/n8n/commit/43c52a8b4f844e91b02e3cc9df92826a2d7b6052"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/n8n-io/n8n"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "n8n Vulnerable to Denial of Service via Malformed Binary Data Requests"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.