graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service
影響: npm:graphql-scalars <= 2.0.0 → 2.0.1
The regular expression behind GraphQLPhoneNumber since 1.24.1 backtracks exponentially. A string made of a run of digits followed by one character that makes the match fail (for example "1".repeat(30) + "x") blocks the JavaScript thread for seconds, and every additional digit doubles the time. graphql-js calls parseLiteral while validating a document and parseValue while coercing variables, so the regex runs for every request that merely contains such a value in a PhoneNumber position, before e…
| CVE | CVE-2026-115887 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 29. 오전 09:48 |
| 데이터 | Markdown JSON |
2026. 10. 29. 오전 06:13, GitHub Advisory Database에서 "graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-115887.