CVE-2026-109563

7.5 HIGHpublic exploit available

Published 2026-10-12 · Updated 2026-10-16

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-1333

Public exploit & PoC references

https://github.com/rdfjs/N3.js
https://github.com/rdfjs/N3.js/commit/b1c497fddb02c4772d61916bd2634115f45f424d
https://github.com/rdfjs/N3.js/pull/760

All references

https://github.com/rdfjs/N3.js
https://github.com/rdfjs/N3.js/commit/b1c497fddb02c4772d61916bd2634115f45f424d
https://github.com/rdfjs/N3.js/pull/760
https://www.vulncheck.com/advisories/n3-js-before-2.11.1-redos-via-n3lexer-numeric-literal-regex

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-100267
UNSCOREDCVE-2026-101903PoC
UNSCOREDCVE-2026-101906PoC
MEDIUMCVE-2026-102270PoC
MEDIUMCVE-2026-102408
MEDIUMCVE-2026-102473
UNSCOREDCVE-2026-102990PoC
HIGHCVE-2026-103043PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.