n8n Instance AI Workflow Summary Prototype Pollution DoS

Technical Analysis

The vulnerability arises from get-or-create-then-nested-write patterns that key JavaScript objects using untrusted strings (node names, connection keys) pulled from stored workflow definitions. Because n8n's editor UI enforces name restrictions only client-side, an attacker can bypass this by posting a workflow directly to the REST API with a key such as `__proto__`, causing property writes to resolve up the prototype chain onto `Object.prototype` rather than creating an own property. This corrupts shared object behavior across the entire main n8n process, impacting all subsequent requests and workflows handled by that instance, effectively enabling a single crafted API call to trigger a process-wide denial of service. The flaw specifically affects the Instance AI workflow summary code path, which is only reachable when `N8N_INSTANCE_AI_MODEL*` environment variables are configured, tying the attack surface to n8n's AI-assisted workflow summarization feature.

Affected Systems

n8n

Detection Signatures

• Workflow JSON payloads containing reserved property names such as __proto__, constructor, or prototype as node names or connection keys
• POST/PUT requests to n8n REST API workflow endpoints containing these reserved keys, especially when the editor UI would normally block them
• Sudden unexplained behavioral changes or errors across unrelated workflows following a single workflow update (indicative of prototype pollution side effects)
• Instance crashes or hangs correlated with Instance AI summary generation shortly after a new/modified workflow is saved via API rather than UI

Remediation Steps

1. 1

   Upgrade n8n

   Update to n8n 2.37.7, 2.38.2, or later, which builds the workflow summary using null-prototype accumulators and validates accepted keys.

2. 2

   Restrict instance access

   Limit access to the n8n instance and its REST API to fully trusted users until upgraded.

3. 3

   Disable Instance AI temporarily

   Remove or leave unset the N8N_INSTANCE_AI_MODEL* environment variables to prevent the vulnerable code path from being reached.

4. 4

   Restart to clear pollution

   If an attack is suspected, restart the n8n process to purge in-memory prototype pollution.

5. 5

   Validate API-submitted workflow keys

   Add server-side validation rejecting reserved property names (__proto__, constructor, prototype) in node/connection keys, independent of client-side editor restrictions.