CVE-2026-109563: N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex
N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using the npm n3 package before version 2.11.1 are exposed when they parse untrusted Turtle or N3 input. The issue can block the Node.js event loop, making services that process attacker-supplied RDF data susceptible to denial of service.
What does an attacker need to exploit it?
An attacker only needs to provide crafted Turtle or N3 content containing a long run of digits that does not terminate a number. No authentication or user interaction is required according to the supplied CVSS vector.
How can I determine whether my application is vulnerable?
Check the installed version of the npm n3 package and whether the application parses untrusted Turtle or N3 data. Versions before 2.11.1 are affected.