CVE-2026-109563

Received Received - Intake

Regular Expression Denial of Service in N3.js

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109563

Affected Vendors & Products

Vendor	Product	Version / Range
rdfjs	N3.js	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Attack-Flow Graph

Executive Summary

N3.js before 2.11.1 has a regular expression denial of service vulnerability in its number pattern. The regex backtracks quadratically when processing long runs of digits in untrusted Turtle or N3 input, causing the Node.js event loop to block and leading to a denial of service.

Detection Guidance

This vulnerability can be detected by monitoring for unusually high CPU usage when processing Turtle or N3 input files with long digit runs. Check if your N3.js version is below 2.11.1 using commands like 'npm list n3' or 'npm view n3 version'.

Impact Analysis

An attacker could exploit this by sending malicious input with long digit sequences, causing the application to hang or crash. This disrupts service availability for all users relying on the affected N3.js library.

Compliance Impact

This vulnerability causes denial of service by blocking the Node.js event loop, which could disrupt services handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could affect the availability of systems processing protected health information.

Mitigation Strategies

Immediately upgrade N3.js to version 2.11.1 or later using 'npm update n3'. If upgrading is not possible, restrict input processing to trusted sources or implement input size limits to prevent long digit runs.

Hi! I’m here to help you understand CVE-2026-109563. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70