Am I affected by n8n: Denial of Service via ZIP decompression in webhook workflow? What should I do?
The Compression node's Decompress operation expanded attacker-controlled archives into memory without enforcing limits on decompressed output size.
Affected: n8n < 2.24.0. Fixed in: 2.24.0. What should you check, and what should you do about it?
Full incident page with sources: https://agentarmorhq.com/incidents/2026/06/cve-2026-54314-n8n (opens external site)
1 answer
Am I affected? Affected: n8n < 2.24.0. Fixed in: 2.24.0.
- Check your version: run
npm ls n8n. Versions < 2.24.0 of n8n are affected.
What to do now
- Upgrade to the fixed version: run
npm install n8n@2.24.0(first patched version 2.24.0). - Upgrade to n8n version 2.24.0 or later to remediate the vulnerability.
- If upgrading is not immediately possible, disable the Compression node by adding
n8n-nodes-base.compressionto theNODES_EXCLUDEenvironment variable. - Restrict public webhook workflows that accept archive file uploads to authenticated endpoints only.
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
Sources
- GitHub Advisory Database: https://github.com/advisories/GHSA-jqpw-qww5-cj4c (opens external site)
Full incident page: https://agentarmorhq.com/incidents/2026/06/cve-2026-54314-n8n (opens external site)
Did this work for you?- Check your version: run