Search
Find a vulnerability
Search criteria
2 vulnerabilities found for N3.js by rdfjs
CVE-2026-109563 (GCVE-0-2026-109563)
Vulnerability from nvd – Published: 2026-10-12 20:55 – Updated: 2026-10-12 20:55
VLAI
EPSS
VEX
Title
N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex
Summary
N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.
Severity
CWE
- CWE-1333 - Inefficient Regular Expression Complexity
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/rdfjs/N3.js/pull/760 | issue-trackingpatch |
| https://github.com/rdfjs/N3.js/commit/b1c497fddb0… | patch |
| https://github.com/rdfjs/N3.js | product |
| https://www.vulncheck.com/advisories/n3-js-before… | third-party-advisory |
Impacted products
Date Public
2026-10-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n3",
"product": "N3.js",
"repo": "https://github.com/rdfjs/N3.js",
"vendor": "rdfjs",
"versions": [
{
"lessThan": "2.11.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.11.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mohammed Arfath A"
}
],
"datePublic": "2026-10-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T20:55:16.880Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Pull Request #760",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/rdfjs/N3.js/pull/760"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/rdfjs/N3.js/commit/b1c497fddb02c4772d61916bd2634115f45f424d"
},
{
"tags": [
"product"
],
"url": "https://github.com/rdfjs/N3.js"
},
{
"name": "VulnCheck Advisory: N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/n3-js-before-2.11.1-redos-via-n3lexer-numeric-literal-regex"
}
],
"title": "N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109563",
"datePublished": "2026-10-12T20:55:16.880Z",
"dateReserved": "2026-10-12T19:27:52.560Z",
"dateUpdated": "2026-10-12T20:55:16.880Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109563 (GCVE-0-2026-109563)
Vulnerability from cvelistv5 – Published: 2026-10-12 20:55 – Updated: 2026-10-12 20:55
VLAI
EPSS
VEX
Title
N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex
Summary
N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.
Severity
CWE
- CWE-1333 - Inefficient Regular Expression Complexity
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/rdfjs/N3.js/pull/760 | issue-trackingpatch |
| https://github.com/rdfjs/N3.js/commit/b1c497fddb0… | patch |
| https://github.com/rdfjs/N3.js | product |
| https://www.vulncheck.com/advisories/n3-js-before… | third-party-advisory |
Impacted products
Date Public
2026-10-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n3",
"product": "N3.js",
"repo": "https://github.com/rdfjs/N3.js",
"vendor": "rdfjs",
"versions": [
{
"lessThan": "2.11.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.11.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mohammed Arfath A"
}
],
"datePublic": "2026-10-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T20:55:16.880Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Pull Request #760",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/rdfjs/N3.js/pull/760"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/rdfjs/N3.js/commit/b1c497fddb02c4772d61916bd2634115f45f424d"
},
{
"tags": [
"product"
],
"url": "https://github.com/rdfjs/N3.js"
},
{
"name": "VulnCheck Advisory: N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/n3-js-before-2.11.1-redos-via-n3lexer-numeric-literal-regex"
}
],
"title": "N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109563",
"datePublished": "2026-10-12T20:55:16.880Z",
"dateReserved": "2026-10-12T19:27:52.560Z",
"dateUpdated": "2026-10-12T20:55:16.880Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}