{"id":"CVE-2025-49595","aliases":["EUVD-2025-19862","GHSA-pr9r-gxgp-9rm8"],"status":"published","title":"n8n Vulnerable to Denial of Service via Malformed Binary Data Requests","description":"n8n is a workflow automation platform. Prior to version 1.99.0, there is a denial of Service vulnerability in /rest/binary-data endpoint when processing empty filesystem URIs (filesystem:// or filesystem-v2://). This allows authenticated attackers to cause service unavailability through malformed filesystem URI requests, effecting the /rest/binary-data endpoint and n8n.cloud instances (confirmed HTTP/2 524 timeout responses). Attackers can exploit this by sending GET requests with empty filesystem URIs (filesystem:// or filesystem-v2://) to the /rest/binary-data endpoint, causing resource exhaustion and service disruption. This issue has been patched in version 1.99.0.","severity":{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00472,"percentile":0.41158,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2025-07-03T12:16:47Z","modified":"2026-10-28T02:31:03Z","fixes":[{"ecosystem":"npm","package":"n8n","fixed_in":["1.99.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"n8n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.99.0"}]}]},{"source":"osv","ecosystem":"npm","package":"n8n","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.99.0"}]}]}],"products":[{"vendor":"n8n","product":"n8n"},{"vendor":"n8n-io","product":"n8n"}],"references":[{"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-pr9r-gxgp-9rm8","tags":["x_refsource_CONFIRM","Patch","Third Party Advisory","advisory","web"]},{"url":"https://github.com/n8n-io/n8n/pull/16229","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/n8n-io/n8n/commit/43c52a8b4f844e91b02e3cc9df92826a2d7b6052","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49595","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pr9r-gxgp-9rm8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49595.json","tags":["advisory"]},{"url":"https://github.com/n8n-io/n8n","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-49595","title":"n8n Vulnerable to Denial of Service via Malformed Binary Data Requests","description":"n8n is a workflow automation platform. Prior to version 1.99.0, there is a denial of Service vulnerability in /rest/binary-data endpoint when processing empty filesystem URIs (filesystem:// or filesystem-v2://). This allows authenticated attackers to cause service unavailability through malformed filesystem URI requests, effecting the /rest/binary-data endpoint and n8n.cloud instances (confirmed HTTP/2 524 timeout responses). Attackers can exploit this by sending GET requests with empty filesystem URIs (filesystem:// or filesystem-v2://) to the /rest/binary-data endpoint, causing resource exhaustion and service disruption. This issue has been patched in version 1.99.0.","status":"published","published":"2025-07-03T12:16:47.207Z","modified":"2025-07-03T13:14:59.815Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:32:24.825718Z"}],"euvd":[{"id":"EUVD-2025-19862","description":"n8n is a workflow automation platform. Prior to version 1.99.0, there is a denial of Service vulnerability in /rest/binary-data endpoint when processing empty filesystem URIs (filesystem:// or filesystem-v2://). This allows authenticated attackers to cause service unavailability through malformed filesystem URI requests, effecting the /rest/binary-data endpoint and n8n.cloud instances (confirmed HTTP/2 524 timeout responses). Attackers can exploit this by sending GET requests with empty filesystem URIs (filesystem:// or filesystem-v2://) to the /rest/binary-data endpoint, causing resource exhaustion and service disruption. This issue has been patched in version 1.99.0.","status":"published","published":"2025-07-03T12:16:47Z","modified":"2025-07-03T13:14:59Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T20:32:14.284181Z"}],"ghsa":[{"id":"GHSA-pr9r-gxgp-9rm8","title":"n8n Vulnerable to Denial of Service via Malformed Binary Data Requests","description":"## Summary\nDenial of Service vulnerability in `/rest/binary-data` endpoint when processing empty filesystem URIs (`filesystem://` or `filesystem-v2://`).\n\n### Impact\nThis is a Denial of Service (DoS) vulnerability that allows authenticated attackers to cause service unavailability through malformed filesystem URI requests. The vulnerability affects:\n\n- The `/rest/binary-data` endpoint\n- n8n.cloud instances (confirmed HTTP/2 524 timeout responses)\n\nAttackers can exploit this by sending GET requests with empty filesystem URIs (`filesystem://` or `filesystem-v2://`) to the `/rest/binary-data` endpoint, causing resource exhaustion and service disruption.\n\n### Patches\n\nThe issue has been patched in [1.99.0](https://github.com/n8n-io/n8n/releases/tag/n8n%401.99.0).\nAll users should upgrade to this version or later.\n\nThe fix introduces strict checking of URI patterns.\n\nPatch commit: https://github.com/n8n-io/n8n/pull/16229","status":"published","published":"2025-07-03T14:06:01Z","modified":"2025-07-03T16:20:45Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:38:48.783737Z"}],"nvd":[{"id":"CVE-2025-49595","description":"n8n is a workflow automation platform. Prior to version 1.99.0, there is a denial of Service vulnerability in /rest/binary-data endpoint when processing empty filesystem URIs (filesystem:// or filesystem-v2://). This allows authenticated attackers to cause service unavailability through malformed filesystem URI requests, effecting the /rest/binary-data endpoint and n8n.cloud instances (confirmed HTTP/2 524 timeout responses). Attackers can exploit this by sending GET requests with empty filesystem URIs (filesystem:// or filesystem-v2://) to the /rest/binary-data endpoint, causing resource exhaustion and service disruption. This issue has been patched in version 1.99.0.","status":"published","published":"2025-07-03T13:15:28.69Z","modified":"2026-06-17T09:31:33.457Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:11:15.754475Z"}],"osv":[{"id":"CVE-2025-49595","title":"n8n Vulnerable to Denial of Service via Malformed Binary Data Requests","description":"n8n is a workflow automation platform. Prior to version 1.99.0, there is a denial of Service vulnerability in /rest/binary-data endpoint when processing empty filesystem URIs (filesystem:// or filesystem-v2://). This allows authenticated attackers to cause service unavailability through malformed filesystem URI requests, effecting the /rest/binary-data endpoint and n8n.cloud instances (confirmed HTTP/2 524 timeout responses). Attackers can exploit this by sending GET requests with empty filesystem URIs (filesystem:// or filesystem-v2://) to the /rest/binary-data endpoint, causing resource exhaustion and service disruption. This issue has been patched in version 1.99.0.","status":"published","published":"2025-07-03T12:16:47.207Z","modified":"2026-10-28T02:31:03.035188423Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"GHSA-pr9r-gxgp-9rm8","title":"n8n Vulnerable to Denial of Service via Malformed Binary Data Requests","description":"## Summary\nDenial of Service vulnerability in `/rest/binary-data` endpoint when processing empty filesystem URIs (`filesystem://` or `filesystem-v2://`).\n\n### Impact\nThis is a Denial of Service (DoS) vulnerability that allows authenticated attackers to cause service unavailability through malformed filesystem URI requests. The vulnerability affects:\n\n- The `/rest/binary-data` endpoint\n- n8n.cloud instances (confirmed HTTP/2 524 timeout responses)\n\nAttackers can exploit this by sending GET requests with empty filesystem URIs (`filesystem://` or `filesystem-v2://`) to the `/rest/binary-data` endpoint, causing resource exhaustion and service disruption.\n\n### Patches\n\nThe issue has been patched in [1.99.0](https://github.com/n8n-io/n8n/releases/tag/n8n%401.99.0).\nAll users should upgrade to this version or later.\n\nThe fix introduces strict checking of URI patterns.\n\nPatch commit: https://github.com/n8n-io/n8n/pull/16229","status":"published","published":"2025-07-03T14:06:01Z","modified":"2025-07-03T16:20:44Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:53.700556Z"}]}}