CVE-2026-115887 in graphql-scalars
Summary
by MITRE • 10/24/2026
GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack exponentially when a PhoneNumber value contains a run of digits followed by a character that makes the match fail. GraphQL evaluates parseLiteral during document validation and parseValue during variable coercion before resolver authentication or authorization, so a small unauthenticated request can block the Node.js event loop and stall the server process. serialize is also affected when unvalidated stored values are returned through the scalar. This issue is fixed in version 2.0.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/24/2026
The vulnerability identified within GraphQL Scalars versions ranging from 1.24.1 to 2.0.1 represents a significant security risk classified as a Regular Expression Denial of Service, commonly referred to as ReDoS. This flaw resides specifically in the PhoneNumber scalar implementation located at src/scalars/PhoneNumber.ts. The core technical issue stems from the use of ambiguous nested digit quantifiers within the regular expression pattern designed to validate phone number formats. These patterns are susceptible to catastrophic backtracking when processing input strings that contain a specific sequence: a run of digits followed by a character that causes the overall match attempt to fail. Instead of failing quickly, the regex engine engages in an exponential search through possible substring matches, consuming excessive CPU resources and effectively freezing the execution context.
From an operational perspective, this vulnerability allows for unauthenticated denial-of-service attacks against applications utilizing GraphQL Scalars. The impact is particularly severe because GraphQL evaluates parseLiteral during document validation and parseValue during variable coercion prior to executing resolver authentication or authorization logic. Consequently, an attacker does not need valid credentials to trigger the flaw. By sending a small, carefully crafted request containing the malicious input pattern, an adversary can block the Node.js event loop. This stall prevents the server process from handling any other requests, leading to a complete service outage for all users connected to that instance. The serialize function is also affected when unvalidated stored values are returned through the scalar, extending the attack surface beyond just incoming request validation.
This vulnerability aligns with CWE-400, which covers Uncontrolled Resource Consumption, and specifically maps to ATT&CK technique T1496, Resource Hijacking, where attackers leverage system resources for denial of service rather than data exfiltration or privilege escalation. The lack of input sanitization before resource-intensive operations highlights a critical gap in defensive coding practices regarding regex complexity management. To mitigate this risk, organizations must immediately upgrade to version 2.0.1 of GraphQL Scalars, which resolves the ambiguous quantifier issue by optimizing the regular expression structure to prevent exponential backtracking. Additionally, implementing strict rate limiting and input length restrictions at the network or API gateway level can provide an additional layer of defense against such resource exhaustion attempts while ensuring that all scalar validations are performed with performance-aware patterns.