CVE-2026-109563
N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer…
- Risk score
- 56/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 12 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial…
- Affected
- See advisory
- Fix
- Upgrade the product to 2.11.1 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
References
Original description
N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.
Last activity 12 Oct 2026. Patch Forecast updates every hour.