Live › vulnerability › CVE-2026-115887
Go to dashboardThe GraphQLPhoneNumber scalar in the graphql-scalars library uses a regular expression with nested digit quantifiers that backtracks exponentially on certain input. A small unauthenticated GraphQL request can block the Node.js event loop and stall the server process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 23:44 UTC. All times on this page are UTC.
Applications running graphql-scalars from 1.24.1 up to but not including 2.0.1 that use the GraphQLPhoneNumber scalar in their schema. The scalar parses input during validation and variable coercion, before authentication runs, so the exposure is reachable by unauthenticated requests on any public GraphQL endpoint that uses it. Teams that do not use GraphQLPhoneNumber, or that already run 2.0.1 or later, can skip it.
No product ranges from the sources yet.
npm ls graphql-scalars (or yarn why graphql-scalars) in the project and check the installed version.GraphQLPhoneNumber from graphql-scalars.2.0.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack exponentially when a PhoneNumber value contains a run of digits followed by a character that makes the match fail. GraphQL evaluates parseLiteral during document validation and parseValue during variable coercion before resolver authentication or authorization, so a small unauthenticated request can block the Node.js event loop and stall the server process. serialize is also affected when unvalidated stored values are returned through the scalar. This issue is fixed in version 2.0.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-115887")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.