graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service

影響: npm:graphql-scalars <= 2.0.0 → 2.0.1

The regular expression behind GraphQLPhoneNumber since 1.24.1 backtracks exponentially. A string made of a run of digits followed by one character that makes the match fail (for example "1".repeat(30) + "x") blocks the JavaScript thread for seconds, and every additional digit doubles the time. graphql-js calls parseLiteral while validating a document and parseValue while coercing variables, so the regex runs for every request that merely contains such a value in a PhoneNumber position, before e…

在 GitHub Advisory Database 阅读

2026/10/29 06:13，GitHub Advisory Database 发布了“graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：JavaScript / Node.js。CVE：CVE-2026-115887。