High 7.5Published Oct 12, 2026

CVE-2026-109563N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex

Updated under an hour ago (2026-10-19 09:10 UTC)

Does this affect you?

It affects rdfjs N3.js. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.35%, higher than 27% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for rdfjs N3.js

Exploited in the last 30 days

N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-1333
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.35% (percentile 27)
Assigned by: VulnCheck
NVD analysis: Awaiting Analysis
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 12, 2026

Affected products

Affected products

rdfjs N3.js rdfjs:n3.js (from the name)	before 2.11.1; 2.11.1 not affected	CNA record

References

https://github.com/rdfjs/N3.js/pull/760issue-tracking, patch
https://github.com/rdfjs/N3.js/commit/b1c497fddb02c4772d61916bd2634115f45f424dpatch
https://github.com/rdfjs/N3.jsproduct
https://www.vulncheck.com/advisories/n3-js-before-2.11.1-redos-via-n3lexer-numeric-literal-regexthird-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.