CVE-2026-109563 — N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex
N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can s…
Published: 2026-10-12 · CVSS: 8.7 · CVSS 4.0
N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7