CVE-2026-109563 rdfjs CVE debrief

Who should care

Defenders responsible for Node.js applications using N3.js before version 2.11.1 should assess exposure and prioritize upgrading to version 2.11.1 or later to prevent potential ReDoS attacks.

Why it matters

CVE-2026-109563 is a high-severity vulnerability in N3.js before version 2.11.1 that can cause a denial of service via a ReDoS attack. Defenders should prioritize upgrading to version 2.11.1 or later and validating user input to prevent potential ReDoS attacks.

• Denial of service via ReDoS attack
• Potential blocking of Node.js event loop
• Required upgrade to version 2.11.1 or later for fix
• Validation of user input recommended

Technical summary

The vulnerability is located in the N3Lexer number pattern in N3.js before version 2.11.1. An attacker can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, causing a denial of service by blocking the Node.js event loop. The vulnerability is caused by a regular expression that backtracks quadratically on long digit runs, leading to a ReDoS attack. Defenders should prioritize upgrading to version 2.11.1 or later and validating user input to prevent potential ReDoS attacks. The vulnerability is considered high-severity and can have a significant impact on affected systems.

Defensive priority

Defenders should prioritize upgrading to version 2.11.1 or later and validating user input to prevent potential ReDoS attacks.

Recommended defensive actions

• Upgrade to version 2.11.1 or later
• Validate user input to prevent potential ReDoS attacks
• Monitor for potential denial of service attacks
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Perform a thorough review of the affected system to ensure it is not vulnerable to other attacks

Evidence notes

The CVE record and source item provide details about the vulnerability, including its location in the N3Lexer number pattern and the potential impact of a ReDoS attack. The vulnerability was reported by a researcher and is being tracked by the CVE Program. The N3.js library is used in various applications, and defenders should review their dependencies to determine if they are affected. The CVE record does not provide additional information about the vulnerability, but it is considered high-severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.