CVE-2026-109563

waiting for further signals

EUVD-2026-97886 ↗

no check availablenot proven exploitable

cve.orgpublic pockev

rdfjs N3.js < 2.11.1

fixed in 2.11.1

CWE-1333 Inefficient Regular Expression Complexity

ETK-2026-1422, permanent identifier

cvss8.7cna vendorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

7d 04h 40msince last run

11mAI analysis

timeline

0 = cve.org publication

trigger signal (cve.org) +0hwaiting for further signals+28h11m

+2h

+4h

+6h

+8h

+10h

description

N3.js versions earlier than 2.11.1 are affected by excessive regular-expression backtracking while tokenizing numeric input. An attacker who can provide Turtle or N3 data for parsing can cause event-loop blockage and deny service.

mitigation

Upgrade N3.js to version 2.11.1 or later. Until upgrading, restrict or pre-validate untrusted Turtle and N3 input, including input size limits.

fixed in 2.11.1

check

exploit

automation

contextual

auth required

EPSS

0.35%27th percentile

agent run time

11m

cve.org record, t = 0

2026-10-12 20:55Z

Δ to public poc

–

Δ to kev

–

outcome

Contextual: an exploit technique exists, but no deterministic check could cover this one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-12 20:55Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-109563

this entry in the feed

GET /api/v1/feed/CVE-2026-109563

{
  "etk_id": "ETK-2026-1422",
  "cve_id": "CVE-2026-109563",
  "display_id": "CVE-2026-109563",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-97886",
  "status": "published",
  "anchor_state": "anchored",
  "title": "N3.js numeric lexer regular expression denial of service",
  "summary": "N3.js versions earlier than 2.11.1 are affected by excessive regular-expression backtracking while tokenizing numeric input. An attacker who can provide Turtle or N3 data for parsing can cause event-loop blockage and deny service.",
  "mitigation": "Upgrade N3.js to version 2.11.1 or later. Until upgrading, restrict or pre-validate untrusted Turtle and N3 input, including input size limits.",
  "vendor": "rdfjs",
  "product": "N3.js",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2.11.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.11.1"
      ],
      "package_name": "N3.js",
      "purl": null
    }
  ],
  "cwes": [
    1333
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0035,
  "epss_percentile": 0.2724,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 11.266499366666666,
  "t0_at": "2026-10-12T20:55:16.880000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-12T20:55:16.880000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T20:55:16.880000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109563"
    }
  }
}

published 2026-10-12 22:01Z
last change 2026-10-21 04:45Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.