The vulnerability allows a crafted regular expression supplied to the Filter and Switch nodes to be compiled and executed synchronously on the worker thread without any safeguard. When a prompt receives an input that contains the malicious pattern, the node attempts to match it against each data item, causing the computational overhead to grow exponentially. This leads to a denial‑of‑service condition that can stall the worker thread for a extended period, blocking other workflow executions and reducing overall service availability. The weakness is a classic Regular Expression Denial of Service, identified by CWE‑1333.

Affected releases include n8n v1.x prior to 1.123.69, any 2.x release before 2.33.4, and 2.34.x before 2.34.1. The product is n8n, an open‑source workflow automation engine offered by n8n‑io. Users running the specified pre‑patched versions on any platform are susceptible when they create or modify a workflow that contains a Filter or Switch node with a user controllable regular expression. Versions after the stated thresholds have the fix applied.

The CVSS score of 5.3 places the issue in the medium‑severity range, and the EPSS score is not available, so we cannot quantify current exploitation prevalence. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would supply a malicious regex, typically by creating or editing a workflow that is executed by the running instance. The impact is restricted to worker threads, so the effect is primarily an availability degradation rather than privilege escalation or data exfiltration. The lack of an automatic timeout suggests the scenario is easily reproducible in a test environment and could be escalated by an attacker with workflow‑creation access or by a compromised client that submits a crafted payload to a workflow endpoint.