The vulnerability is a prototype pollution flaw in n8n. Low‑privileged users can create workflows containing specially named connection keys, such as __proto__, which the automated history‑compaction task processes. When the task manipulates these keys, internal JavaScript object structures are altered, leading to unexpected server errors that block login and write operations. The flaw is classified as CWE‑1321 and results in a denial‑of‑service condition that can affect the entire application on the affected node.

Affected are installations of n8n prior to version 2.41.4 and prior to 2.42.1. This includes all versions 2.41.x older than 2.41.4 and 2.42.x older than 2.42.1 running the n8n workflow automation engine.

The CVSS score of 7.1 indicates a high severity weakness. Because the exploit requires only creation of a workflow, which is normally allowed to lower‑privileged users, the attack surface is large, although no public proof‑of‑concept is available. The EPSS score is not provided; it is therefore uncertain how frequently attackers might target this flaw in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. The best estimate is that an attacker can perform a denial‑of‑service attack by triggering the history‑compaction routine, thus causing application outages with minimal effort.