CVE-2026-109563
Description
A flaw was found in N3.js. A remote attacker can cause a Denial of Service (DoS) by supplying specially crafted Turtle or N3 document input containing long sequences of digits that do not complete a valid number. Due to inefficient regular expression evaluation in the lexical analyzer (N3Lexer), processing this input causes excessive backtracking that blocks the application event loop and leaves the service unresponsive.
Statement
This vulnerability is rated as Important because unauthenticated network users can remotely stall the application's single-threaded event loop without privileges or user interaction, precipitating a complete denial of service. Applications utilizing the N3.js library to parse RDF data directly from external or untrusted sources are vulnerable to event-loop starvation. Services that process RDF payloads solely from trusted boundaries or internal endpoints face significantly reduced operational exposure.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
Attackers can create crafted inputs that intentionally cause the regular expression to use excessive backtracking in a way that causes the CPU consumption to spike.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
