[ CVE-2026-109563 · Published 12 Oct 2026 ]
Vulnerability in rdfjs N3.js
CVSS 7.5
EPSS <1%No fix listed yet
[ Description ]Official description
N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.