N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs.
CVSS 4.0HIGH 8.7·Network·No auth·No interaction·EPSS 0.00346·Published 2026-10-12·Fixed in 2.11.1CWE-1333