CVE-2026-109563: N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-12 · updated 2026-10-16
Weakness: CWE-1333

Description

N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.

Affected products

rdfjs N3.js: before 2.11.1 — fixed in 2.11.1

How to fix

Upgrade to a fixed version: rdfjs N3.js 2.11.1. Check the vendor advisory for mitigations.

References

https://github.com/rdfjs/N3.js
https://github.com/rdfjs/N3.js/commit/b1c497fddb02c4772d61916bd2634115f45f424d
https://github.com/rdfjs/N3.js/pull/760
https://www.vulncheck.com/advisories/n3-js-before-2.11.1-redos-via-n3lexer-numeric-literal-regex

Get alerted when CVE-2026-109563 or the next vulnerability affects your stack