N3.js versions prior to 2.11.1 contain a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically when processing long runs of digits that do not form a valid numeric literal. Attackers can supply untrusted Turtle or N3 input containing such digit runs, causing the Node.js event loop to become blocked and resulting in a denial of service to users of the application.

Vendors: rdfjs; Product: N3.js. All releases before version 2.11.1 are affected; versions 2.11.1 and later have the fix applied.

The CVSS score of 8.7 indicates a high severity and the vulnerability is not listed in CISA KEV. EPSS information is not available. The likely attack vector is the ability to provide arbitrary Turtle or N3 input to an application that imports and parses this data with N3.js, which could be local or remote depending on the software’s use case. Due to the quadratic backtracking, an attacker can trigger CPU exhaustion by delivering a single input payload that forces the regex engine to perform an exponential amount of work, thereby blocking all Node.js activity within the process.