N3.js EUVD-2026-97886

The affected application must use N3.js before 2.11.1 to parse Turtle or N3 input that is attacker-controlled (e.g. an endpoint, upload, or background job that feeds untrusted RDF documents into the N3 parser/lexer). The specific trigger is input containing a long run of digits that does not form a complete numeric literal, which drives the N3Lexer number pattern into quadratic backtracking. CVSS is AV:N/AC:L/PR:N/UI:N, so no authentication, special configuration, or user interaction is required - exploitation is limited only by whether the deployment actually exposes N3.js parsing to untrusted input. Deployments that parse only trusted/internal RDF are not practically at risk. Impact is confined to denial of service via event-loop blocking; there is no data or integrity impact.

This is a genuine but bounded availability risk. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H, base 8.7) is internally consistent with the description: a remote, unauthenticated attacker with low complexity can cause a high availability impact and zero confidentiality or integrity impact. The high 8.7 score is driven entirely by the VA:H availability metric - there is NO data exposure or code execution, so this should not be triaged at the same urgency as a critical RCE despite the 'High' rating. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and NO public proof-of-concept is referenced, so there is no public exploit identified at time of analysis; the only intelligence sources are the VulnCheck advisory and the vendor's own GitHub commit/PR. The signals are non-conflicting: a config-independent ReDoS in a widely-used parser, remotely reachable wherever the library parses untrusted input, but with impact limited to denial of service and no confirmed in-the-wild activity. Real priority is moderate - patch promptly for any service that parses attacker-controlled Turtle/N3, but this is not an emergency on the level of an exploited RCE.

An application uses N3.js (before 2.11.1) to parse Turtle or N3 documents supplied by untrusted users - for example an RDF ingestion endpoint or a SPARQL/linked-data upload feature. An attacker submits a document containing a long run of digits that does not terminate as a valid number, causing the N3Lexer numeric-literal regex to backtrack quadratically and block the single-threaded Node.js event loop, rendering the service unresponsive to all clients. No public exploit code is identified, but the trigger is trivial to construct from the public patch diff.