graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service

影響: npm:graphql-scalars <= 2.0.0 → 2.0.1

The regular expression behind GraphQLPhoneNumber since 1.24.1 backtracks exponentially. A string made of a run of digits followed by one character that makes the match fail (for example "1".repeat(30) + "x") blocks the JavaScript thread for seconds, and every additional digit doubles the time. graphql-js calls parseLiteral while validating a document and parseValue while coercing variables, so the regex runs for every request that merely contains such a value in a PhoneNumber position, before e…

GitHub Advisory Databaseで読む

2026/10/29 06:13、GitHub Advisory Databaseが「graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: JavaScript / Node.js。CVE: CVE-2026-115887。