N3.js: Regular expression denial of service in N3Lexer number parsing
Summary
N3.js, an RDF library for Node.js, contains a ReDoS flaw in the N3Lexer number pattern. Long runs of digits that do not end a number cause quadratic backtracking, which blocks the Node.js event loop. An attacker who can supply untrusted Turtle or N3 input can cause a denial of service; no confidentiality or integrity impact is documented.
Affected
- N3.js before 2.11.1 (per CVE record: versions 0 to < 2.11.1)
- Discrepancy: VulDB describes the issue as up to 2.11.0; OSV lists a different fixed commit than the one cited in the CVE references. Unknown which commit contains the fix.
- Distribution packages (node-n3 in Ubuntu): Needs evaluation. Debian: urgency not yet assigned.
Fixed in
- N3.js 2.11.1 or later (vendor fix commit b1c497fd, PR #760)
- Unknown for distribution packages.
Workaround
- No vendor workaround documented.
- Interim measure (not from vendor): limit the size of RDF input before parsing, parse with a timeout or in a separate worker process, and restrict who can submit RDF input.
Exploitation
- No known exploitation in the wild; not listed in CISA KEV.
- CISA SSVC: Exploitation none, automatable yes, technical impact partial.
- No public exploit or PoC found. The fix commit is public, so the flaw can be located from the patch.
- EPSS 0.0035.
Our recommendation
- Identify applications using N3.js, directly or through downstream packages such as @rdfjs/parser-n3.
- Upgrade to N3.js 2.11.1 or later, after regression testing.
- Until patched, limit input size, run parsing with a timeout or in a separate process, and restrict untrusted RDF input.
- Monitor the vendor repository and your distribution for fix versions.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record reference: N3.js repository github.com
- Fix commit b1c497fd github.com
- Pull request #760 github.com
- VulnCheck advisory www.vulncheck.com
- VulDB entry 417249 vuldb.com
- Ubuntu security notice ubuntu.com
- OSV entry osv.dev
- Debian OSV entry osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:43.
Original description (NVD)
N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.