N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Oct 12, 2026 · NIST NVD

   Detected

   N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.

2. Oct 14, 2026 · NIST NVD

   Updated

   N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.

Sources

• CVE.orgVulnerability recordCVE-2026-109563

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-109563

  30-day exploitation probability 0.4%

  first.org
• NIST NVDVulnerability recordCVE-2026-109563

  N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking th

  nvd.nist.gov

References

• Reference · github.com
• Reference · github.com
• Reference · github.com
• Reference · vulncheck.com