CVE-2026-109563

CVSS 8.7 (high) · published 2026-10-12

N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.

Weakness: CWE-1333

Source: NVD CVE-2026-109563

References

• https://github.com/rdfjs/N3.js
• https://github.com/rdfjs/N3.js/commit/b1c497fddb02c4772d61916bd2634115f45f424d
• https://github.com/rdfjs/N3.js/pull/760
• https://www.vulncheck.com/advisories/n3-js-before-2.11.1-redos-via-n3lexer-numeric-literal-regex

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.