CVE-2026-109563 in N3.js
Summary
by MITRE • 10/13/2026
N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified within versions of N3.js prior to 2.11.1 represents a significant regular expression denial of service flaw located specifically in the lexer component responsible for parsing numeric literals. This issue stems from an inefficient implementation of the regex pattern used to match numbers, which exhibits quadratic backtracking behavior when processing input strings containing long sequences of digits that do not constitute valid number terminations. In computer science terms this is a classic ReDoS vulnerability where the regular expression engine attempts multiple combinations of matches against the input string before failing or succeeding, leading to exponential increases in computational time relative to the length of the input data rather than linear growth.
From an operational perspective this flaw allows remote attackers to craft malicious Turtle or N3 formatted documents that contain excessively long runs of digits without proper delimiters or termination characters such as whitespace or punctuation. When a server application utilizing vulnerable versions of N3.js processes these specially crafted inputs, the underlying Node.js event loop becomes blocked due to the excessive CPU time consumed by the regex engine during its backtracking process. Since Node.js operates on a single-threaded event loop model any prolonged blocking operation prevents the execution of other concurrent tasks including handling new network requests processing timers or executing asynchronous callbacks effectively rendering the application unresponsive and causing a denial of service condition for all users attempting to interact with the affected system.
This vulnerability aligns closely with CWE-400 which describes Uncontrolled Resource Consumption often resulting from inefficient algorithms in regular expressions. The attack vector is classified under MITRE ATT&CK technique T1496 as Resource Hijacking where an attacker consumes resources such as CPU or memory to degrade service availability for legitimate users. Unlike typical injection attacks that aim to execute arbitrary code this vulnerability focuses purely on disrupting availability through computational exhaustion leveraging the inherent behavior of backtracking regex engines in JavaScript environments which are particularly susceptible to such patterns when input validation is insufficiently strict regarding numeric formats.
Mitigation strategies primarily involve upgrading N3.js to version 2.11.1 or later where the regular expression has been optimized to prevent quadratic backtracking and enforce stricter parsing rules for number literals. For organizations unable to immediately upgrade, implementing a Web Application Firewall rule that limits the length of incoming request bodies containing Turtle or N3 content can provide temporary protection by rejecting payloads with excessively long digit sequences before they reach the application layer. Additionally developers should ensure that any custom parsers or wrappers around N3.js implement strict input sanitization and timeout mechanisms to detect and abort processing if parsing operations exceed expected time thresholds thereby preserving system stability even in the presence of malicious inputs.