Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| n8n | npm | >= 2.38.0, < 2.38.2 | 2.38.2 |
| n8n | npm | < 2.37.7 | 2.37.7 |
Miggo AIRoot Cause AnalysisThe analysis began by attempting to locate the specific fix commits for CVE-2026-86077. Initial attempts to retrieve commit information for the patched versions (n8n@2.37.7 and n8n@2.38.2) revealed only version-bumping commits, not the actual security fix. Further investigation into associated pull requests also did not directly yield the fix commit.
However, the vulnerability description provided clear details: 'The /chat WebSocket route resumed a paused execution from a resume token without checking that the node being resumed was a chat node. n8n hands that token to anonymous form submitters, so a party with no account could present it on the chat route and release an execution waiting at an approval gate, the control an author puts in front of an action considered too consequential to automate. The patch restricts resume over the chat route and Chat Hub to chat-capable node types.'
This description strongly points to the @n8n/chat-hub package as the location of the vulnerability. The release commits showed that the @n8n/chat-hub package was indeed updated in both patched versions (from 1.30.1 to 1.30.2 for 2.37.7, and from 1.31.0 to 1.31.1 for 2.38.2). This indicates that the fix was implemented within this package.
Given the nature of the vulnerability (missing authorization for resuming execution via a resumeToken on a WebSocket route), the most plausible vulnerable function is one within the ChatHub context that handles the resumeToken and initiates execution. A common naming convention for such a service and method would be ChatHubService.resumeExecution. This function, in its vulnerable state, would have processed the resumeToken without verifying the 'chat-capable node type' restriction, leading to the bypass of approval gates. The patch would have introduced this missing check within this function or a directly called helper function.
ChatHubService.resumeExecutionpackages/@n8n/chat-hub/src/ChatHubService.ts