graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service

影響: npm:graphql-scalars <= 2.0.0 → 2.0.1

The regular expression behind GraphQLPhoneNumber since 1.24.1 backtracks exponentially. A string made of a run of digits followed by one character that makes the match fail (for example "1".repeat(30) + "x") blocks the JavaScript thread for seconds, and every additional digit doubles the time. graphql-js calls parseLiteral while validating a document and parseValue while coercing variables, so the regex runs for every request that merely contains such a value in a PhoneNumber position, before e…

Read on GitHub Advisory Database

On 10/29/2026, 06:13 AM, GitHub Advisory Database published "graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service" (type: Advisory). Severity is "High" (high). Related technologies: JavaScript / Node.js. CVE: CVE-2026-115887.