High, CVSS 7.5npmAmendedPublished
graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service
CVE-2026-115887 · GHSA-x8rm-f576-gq67
- Affected
- npm graphql-scalars >= 1.24.1, < 2.0.1
- Fixed in
- 2.0.1· Vendor fix available
- Issue
- The regular expression behind `GraphQLPhoneNumber` since 1.24.1 backtracks exponentially. A string made of a run of digits followed by one character that makes the match fail (for example `"1".repeat(30) + "x"`) blocks the JavaScript thread for seconds, and every additional digit doubles the time. graphql-js calls `parseLiteral` while *validating* a document and `parseValue` while coercing variables, so the regex runs for every request that merely contains such a value in a `PhoneNumber` position, before execution and before any authentication or authorization step of the server. One small unauthenticated request is enough to stall a server process. Affected versions - `graphql-scalars` >= 1.24.1, <= 2.0.0 (2.0.0 is the current `latest`; the default branch still has the same pattern). - Not affected: 1.24.0 and the earlier versions I checked (1.22.4, 1.23.0), which use the linear `/^\+[1-9]\d{6,14}$/`. - Introduced by #2719 (c7f58da16, "PhoneNumber scalar is not fully…
Recommended action: Upgrade to 2.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.