CVE-2026-109563CWE-1333

CVE-2026-109563

High · published October 13, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
27.4
In the wild
Unconfirmed
What it is

N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00350 · 27.4th percentile
Weakness
CWE-1333 · Inefficient Regular Expression Complexity
Published
2026-10-13T01:17Z
References (4)
https://github.com/rdfjs/N3.js · [email protected]https://github.com/rdfjs/N3.js/commit/b1c497fddb02c4772d61916bd2634115f45f424d · [email protected]https://github.com/rdfjs/N3.js/pull/760 · [email protected]https://www.vulncheck.com/advisories/n3-js-before-2.11.1-redos-via-n3lexer-numeric-literal-regex · [email protected]
EPSS history
Timeline
  • 14 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 12 OCT 20:55Z
    N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex
    cvelistv5
  • 12 OCT 20:55Z
    N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex
    cvelistv5