n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirect_uris but accepted arbitrarily large client_name and grant_types values. An unauthenticated remote caller could repeatedly persist oversized values in oauth_clients and exhaust database storage. The affected validation is in packages/cli/src/modules/oauth-server/oauth-server.service.ts, including MAX_CLIENT_NAME_LENGTH and MAX_GRANT_TYPES. This issue is fixed in versions 2.37.7 and 2.38.2.
CVSS v3.1 Score
7.5
/ 10.0
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Information
- Published
- 8 sept. 2026
- Updated
- 11 sept. 2026
- Status
- Analyzed
- Source
- security-advisories@github.com
Affected products
n8n n8n
Versions : 2.37.7, 2.38.2
Weaknesses (CWE)
CWE-770
References (3)
- https://github.com/n8n-io/n8n/security/advisories/GHSA-hh89-3r9w-qj3jMitigationVendor Advisory
Similar CVEs
Other vulnerabilities of type CWE-770
Loading…
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.