CVE-2026-109563

7.5High

Published 12 Oct 2026 · NVD status: Received

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on availability
Weakness: CWE-1333

The AI triage for this one isn't ready yet. Check back in a few minutes; the full NVD record is below in the meantime.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Ad · In-content banner

NVD description

N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.

References

https://github.com/rdfjs/N3.js
https://github.com/rdfjs/N3.js/commit/b1c497fddb02c4772d61916bd2634115f45f424d
https://github.com/rdfjs/N3.js/pull/760
https://www.vulncheck.com/advisories/n3-js-before-2.11.1-redos-via-n3lexer-numeric-literal-regex

Source: nvd.nist.gov/vuln/detail/CVE-2026-109563