{"id":"ghsa-ghsa-x8rm-f576-gq67","seq":2056938,"kind":"advisory","title":"graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service","url":"https://github.com/advisories/GHSA-x8rm-f576-gq67","permalink":"https://vulnpulse.app/items/ghsa-ghsa-x8rm-f576-gq67","summary":"影響: npm:graphql-scalars <= 2.0.0 → 2.0.1\nThe regular expression behind GraphQLPhoneNumber since 1.24.1 backtracks exponentially. A string made of a run of digits followed by one character that makes the match fail (for example \"1\".repeat(30) + \"x\") blocks the JavaScript thread for seconds, and every additional digit doubles the time. graphql-js calls parseLiteral while validating a document and parseValue while coercing variables, so the regex runs for every request that merely contains such a value in a PhoneNumber position, before e…","severity":"high","techs":["nodejs"],"cves":["CVE-2026-115887"],"tags":["GHSA-x8rm-f576-gq67","graphql-scalars"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:13:10.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}