Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck
CVE-2026-109563N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex
High 7.5
In plain English
A high-severity regular-expression denial of service in N3.js from rdfjs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 71.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | node-n3 | no fix listed | DEBIAN-CVE-2026-109563 |
| Debian:13 | node-n3 | no fix listed | DEBIAN-CVE-2026-109563 |
| Debian:14 | node-n3 | no fix listed | DEBIAN-CVE-2026-109563 |
| Ubuntu:22.04:LTS | node-n3 | no fix listed | UBUNTU-CVE-2026-109563 |
| Ubuntu:24.04:LTS | node-n3 | no fix listed | UBUNTU-CVE-2026-109563 |
| Ubuntu:26.04:LTS | node-n3 | no fix listed | UBUNTU-CVE-2026-109563 |
| Ubuntu:26.10 | node-n3 | no fix listed | UBUNTU-CVE-2026-109563 |
Affected products (as reported)
Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- GitHub Pull Request #760 issue-tracking, patch
- Patch Commit patch
- https://github.com/rdfjs/N3.js product
- VulnCheck Advisory: N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex third-party-advisory