All vulnerabilities
CVE-2026-109563

N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex

rdfjs N3.js
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.35%Chance of exploitation activity in the next 30 days, higher than 27% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.11.1Fixed versionCVE List
Published12 Oct 2026Updated 14 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.

Text from CVE List

Affected versions 2

  • N3.jsaffected: all versions before 2.11.1CVE List
  • N3.jsunaffected: 2.11.1CVE List

References 4