CVE-2025-49595

n8n is a workflow automation platform. Prior to version 1.99.0, there is a denial of Service vulnerability in /rest/binary-data endpoint when processing empty filesystem URIs (filesystem:// or filesystem-v2://). This allows authenticated attackers to cause service unavailability through malformed filesystem URI requests, effecting the /rest/binary-data endpoint and n8n.cloud instances (confirmed HTTP/2 524 timeout responses). Attackers can exploit this by sending GET requests with empty filesystem URIs (filesystem:// or filesystem-v2://) to the /rest/binary-data endpoint, causing resource exhaustion and service disruption. This issue has been patched in version 1.99.0.

• CWE-400

• https://github.com/n8n-io/n8n/commit/43c52a8b4f844e91b02e3cc9df92826a2d7b6052Patch
• https://github.com/n8n-io/n8n/pull/16229Patch
• https://github.com/n8n-io/n8n/security/advisories/GHSA-pr9r-gxgp-9rm8Patch, Third Party Advisory

Published

Jul 3, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-49589PCSX2 is a free and open-source PlayStation 2 (PS2) emulator…6.1
• CVE-2025-49590CryptPad is a collaboration suite. Prior to version 2025.3.0…6.1
• CVE-2025-49591CryptPad is a collaboration suite. Prior to version 2025.3.0…9.1
• CVE-2025-49592n8n is a workflow automation platform. Versions prior to 1.9…5.4
• CVE-2025-49593Portainer Community Edition is a lightweight service deliver…6.8
• CVE-2025-49594XWiki OIDC has various tools to manipulate OpenID Connect pr…9.2
• CVE-2025-49596The MCP inspector is a developer tool for testing and debugg…9.4
• CVE-2025-49597handcraftedinthealps goodby-csv is a highly memory efficient…3.9
• CVE-2025-49598conda-forge-ci-setup is a package installed by conda-forge e…4.4
• CVE-2025-49599Huawei EG8141A5 devices through V5R019C00S100, EG8145V5 devi…4.1
• CVE-2025-4960The com.epson.InstallNavi.helper tool, deployed with the EPS…7.8
• CVE-2025-49600In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_verify may accept…4.9