CVE-2026-109563

Name	CVE-2026-109563
Description	N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1150935

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
node-n3 (PTS)	bookworm, trixie	1.16.3+~1.2.3+~1.10.4-1	vulnerable
	forky, sid	1.16.3+~1.2.3+~1.10.4-3	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
node-n3	source	(unstable)	(unfixed)			1150935

Notes

[trixie] - node-n3 <no-dsa> (Minor issue)
[bookworm] - node-n3 <postponed> (Minor issue; can be fixed in next update)
https://github.com/rdfjs/N3.js/pull/760
Fixed by: https://github.com/rdfjs/N3.js/commit/b1c497fddb02c4772d61916bd2634115f45f424d (v2.11.1)