Regular Expression Vulnerability in N3.js by RDF.js

CVE-2026-109563

What is CVE-2026-109563?

N3.js prior to version 2.11.1 is susceptible to a regular expression denial of service (ReDoS) vulnerability due to a flaw in the N3Lexer component's regex for number patterns. Attackers can exploit this by providing crafted Turtle or N3 input featuring extended sequences of digits that do not terminate a valid number. This exploitation results in excessive backtracking, leading to the blocking of the Node.js event loop, ultimately causing a denial of service.

References