6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54314

CVE-2026-54314: n8n: Denial of Service via ZIP decompression in webhook workflow

n8n is an open source workflow automation platform. Prior to 2.24.0, the Compression node's Decompress operation expanded attacker-controlled archives into memory without enforcing limits on decompressed output size. An unauthenticated attacker could send a small compressed archive to a public webhook workflow using this node, causing the n8n process to terminate due to memory exhaustion and disrupting all workflows in the same instance. This vulnerability is fixed in 2.24.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54314

CVE-2026-54314:

6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
n8n	npm	< 2.24.0	2.24.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the 'Decompress' operation of the 'Compression' node in n8n. The core of the issue is the lack of limits on the size of the decompressed output, which could lead to memory exhaustion and a denial-of-service attack. The analysis of the Compression.node.ts file reveals that the execute method is the central point of execution for this node. The vulnerability is specifically triggered within the if (operation === 'decompress') block of this method. The patch for this vulnerability involved introducing two new functions, boundedUnzip and boundedGunzip, which wrap the decompression logic with size and entry-count limitations. Therefore, the primary vulnerable function is Compression.execute, as it is the function that, in its unpatched state, would perform the unsafe decompression. The functions boundedUnzip and boundedGunzip are indicators of the patch and would not be present in a vulnerable version's runtime profile during exploitation.

Vulnerable functions

Compression.execute

packages/nodes-base/nodes/Compression/Compression.node.ts

The `execute` method in the `Compression` class is responsible for handling both compression and decompression operations. When the 'decompress' operation is selected, this function is responsible for processing the user-provided archive. Prior to the patch, the function would decompress the archive without any limits on the output size, making it vulnerable to a denial-of-service attack via a compressed archive (zip bomb). An attacker could provide a small, highly compressed file that, when decompressed, would exhaust the system's memory, causing the n8n instance to crash.

boundedUnzip

packages/nodes-base/nodes/Compression/decompress/BoundedUnzip.ts

This function was added as a security mitigation. It's a wrapper around a standard unzip function that includes checks to prevent zip bomb attacks. It's not vulnerable itself, but its presence in a stack trace would indicate that the patched version of the code is running. The vulnerable version of the code would not have this function.

boundedGunzip

packages/nodes-base/nodes/Compression/decompress/BoundedGunzip.ts

Similar to `boundedUnzip`, this function was added as a security mitigation for handling gzip files. It's not vulnerable, but its presence indicates a patched version. The vulnerable code would have used a gunzip function without size limits.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.