CVE-2026-115887
GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL…
- Risk score
- 61/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.7%
- Published
- 23 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack exponentially when a PhoneNumber value contains a run of digits followed by a character…
- Affected
- See advisory
- Fix
- Upgrade the product to 2.0.1 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 7.5 high
- Remotely exploitable without logging in
References
- https://github.com/graphql-hive/graphql-scalars/commit/210fd2485641afa2452800c00144245c74361701
- https://github.com/graphql-hive/graphql-scalars/pull/2719
- https://github.com/graphql-hive/graphql-scalars/releases/tag/v2.0.1
- https://github.com/graphql-hive/graphql-scalars/security/advisories/GHSA-x8rm-f576-gq67
Original description
GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack exponentially when a PhoneNumber value contains a run of digits followed by a character that makes the match fail. GraphQL evaluates parseLiteral during document validation and parseValue during variable coercion before resolver authentication or authorization, so a small unauthenticated request can block the Node.js event loop and stall the server process. serialize is also affected when unvalidated stored values are returned through the scalar. This issue is fixed in version 2.0.1.
Last activity 23 Oct 2026. Patch Forecast updates every hour.