CVE WATCH / VULNERABILITY DETAIL
CVE-2026-109563
HIGHCVSS 7.5NVD feed
Published 12 October 2026 · tracked since 13 October 2026
Description
N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-104935
- CVE-2026-109573 HIGH 8.1
- CVE-2026-84312 HIGH 7.1
- CVE-2026-41210 MEDIUM 6.5
- CVE-2026-84316 HIGH 8.8
- CVE-2026-84317 HIGH 8.8
- CVE-2026-84318 HIGH 8.8
- CVE-2026-84319 HIGH 8.3
- CVE-2026-84320 MEDIUM 6.3
- CVE-2026-84321 MEDIUM 5.4