High severity7.5NVD Advisory· Published Sep 8, 2026· Updated Sep 11, 2026
CVE-2026-86075
CVE-2026-86075
Description
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirect_uris but accepted arbitrarily large client_name and grant_types values. An unauthenticated remote caller could repeatedly persist oversized values in oauth_clients and exhaust database storage. The affected validation is in packages/cli/src/modules/oauth-server/oauth-server.service.ts, including MAX_CLIENT_NAME_LENGTH and MAX_GRANT_TYPES. This issue is fixed in versions 2.37.7 and 2.38.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
n8nnpm | >= 2.38.0, < 2.38.2 | 2.38.2 |
n8nnpm | < 2.37.7 | 2.37.7 |
Affected products
1Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-hh89-3r9w-qj3jghsaADVISORY
- github.com/n8n-io/n8n/security/advisories/GHSA-hh89-3r9w-qj3jnvdMitigationVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-86075ghsaADVISORY
- github.com/n8n-io/n8n/releases/tag/[email protected]nvdRelease NotesWEB
- github.com/n8n-io/n8n/releases/tag/[email protected]nvdRelease NotesWEB
News mentions
1- N8n Io: 17 Vulnerabilities Disclosed Together Impacting Workflow Automation PlatformVypr Intelligence · Sep 8, 2026