## graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service

- 種別: advisory
- 重大度: high
- 関連技術: nodejs
- CVE: CVE-2026-115887
- 公開日時: 2026-10-28T21:13:10.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-x8rm-f576-gq67)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-x8rm-f576-gq67

影響: npm:graphql-scalars <= 2.0.0 → 2.0.1
The regular expression behind GraphQLPhoneNumber since 1.24.1 backtracks exponentially. A string made of a run of digits followed by one character that makes the match fail (for example "1".repeat(30) + "x") blocks the JavaScript thread for seconds, and every additional digit doubles the time. graphql-js calls parseLiteral while validating a document and parseValue while coercing variables, so the regex runs for every request that merely contains such a value in a PhoneNumber position, before e…