CVE catalog

CVE-2026-109563

N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle

[CVE catalog]

Severity
High · CVSS 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.35% · Oct 25, 2026

N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-n3sid1.16.3+~1.2.3+~1.10.4-3vulnerable
Debiannode-n3forky1.16.3+~1.2.3+~1.10.4-3vulnerable
Debiannode-n3trixie1.16.3+~1.2.3+~1.10.4-1vulnerable
Debiannode-n3bookworm1.16.3+~1.2.3+~1.10.4-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannode-n3sourcesid(unfixed)not yet assignedNot reported[1150935]
Debiannode-n3sourceforky(unfixed)not yet assignedNot reported[1150935]
Debiannode-n3sourcetrixie(unfixed)not yet assignedNot reported[1150935]
Debiannode-n3sourcebookworm(unfixed)not yet assignedNot reported[1150935]

[Debian bug #1150935]

Notes

[trixie] node-n3: Minor issue [bookworm] node-n3: Minor issue; can be fixed in next update

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libjs-n3]Affected

    Source package: [node-n3]

    Details (2)

    • 1.16.3+~1.2.3+~1.10.4-1 · all · bookworm

      Affected

      nvd · node-n3 · debian · bookworm; nvd · node-n3 · debian · 12

    • 1.16.3+~1.2.3+~1.10.4-1 · all · bookworm

      Affected

      nvd · node-n3 · debian · bookworm; nvd · node-n3 · debian · 12

  • [node-n3]Affected
    Details (2)

    • 1.16.3+~1.2.3+~1.10.4-1 · all · bookworm

      Affected

      nvd · node-n3 · debian · bookworm; nvd · node-n3 · debian · 12

    • 1.16.3+~1.2.3+~1.10.4-1 · all · bookworm

      Affected

      nvd · node-n3 · debian · bookworm; nvd · node-n3 · debian · 12

[Debian 13 (Trixie)]

  • [libjs-n3]Affected

    Source package: [node-n3]

    Details (2)

    • 1.16.3+~1.2.3+~1.10.4-1 · all · trixie

      Affected

      nvd · node-n3 · debian · 13

    • 1.16.3+~1.2.3+~1.10.4-1 · all · trixie

      Affected

      nvd · node-n3 · debian · 13

  • [node-n3]Affected
    Details (2)

    • 1.16.3+~1.2.3+~1.10.4-1 · all · trixie

      Affected

      nvd · node-n3 · debian · 13

    • 1.16.3+~1.2.3+~1.10.4-1 · all · trixie

      Affected

      nvd · node-n3 · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]