Denial of Service vulnerability in /rest/binary-data
endpoint when processing empty filesystem URIs (filesystem://
or filesystem-v2://
).
This is a Denial of Service (DoS) vulnerability that allows authenticated attackers to cause service unavailability through malformed filesystem URI requests. The vulnerability affects:
/rest/binary-data
endpointAttackers can exploit this by sending GET requests with empty filesystem URIs (filesystem://
or filesystem-v2://
) to the /rest/binary-data
endpoint, causing resource exhaustion and service disruption.
The issue has been patched in 1.99.0. All users should upgrade to this version or later.
The fix introduces strict checking of URI patterns.
Patch commit: https://github.com/n8n-io/n8n/pull/16229
{ "github_reviewed_at": "2025-07-03T14:06:01Z", "github_reviewed": true, "nvd_published_at": "2025-07-03T13:15:28Z", "cwe_ids": [ "CWE-400" ], "severity": "MODERATE" }