CVE-2026-63460 in Vendure
Summary
by MITRE • 09/17/2026
Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically backtracking pattern through StringOperators.regex. packages/core/src/service/helpers/list-query-builder/parse-filter-params.ts passes the raw pattern to the REGEXP implementation registered by packages/core/src/service/helpers/list-query-builder/list-query-builder.ts, and better-sqlite3 and sqljs evaluate it synchronously in the Node.js event loop. ShopProductsResolver.products is publicly reachable, so one nested-quantifier pattern can block request processing and make the storefront and admin API unavailable, while repeated requests can sustain denial of service. PostgreSQL and MySQL or MariaDB deployments do not execute this regular expression in the Node.js event loop. This issue is fixed in version 3.6.5.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/17/2026
Vendure is an open-source headless commerce platform designed to provide flexible e-commerce solutions through a GraphQL API interface. A critical vulnerability exists within versions prior to 3.6.5, specifically affecting the public Shop GraphQL API when it interacts with database backends that execute regular expressions synchronously on the Node.js event loop. The flaw resides in how the application processes filter parameters for product queries, allowing an unauthenticated attacker to trigger a catastrophic performance degradation known as ReDoS or Regular Expression Denial of Service. This vulnerability is classified under CWE-1386 and aligns with ATT&CK technique T1499 Endpoint Denial of Service, where attackers leverage software vulnerabilities to disrupt service availability rather than stealing data or gaining unauthorized access directly.
The technical root cause lies in the implementation of string filtering within the list query builder component. Specifically, the function responsible for parsing filter parameters passes raw user-supplied strings directly into a REGEXP execution engine without adequate validation or sanitization of the pattern structure. When an attacker supplies a crafted input containing nested quantifiers, such as multiple instances of grouping and repetition operators like (a+)+, the regular expression engine enters a state of catastrophic backtracking. Instead of failing quickly on invalid matches, the engine exhaustively explores all possible ways to match parts of the string against the pattern before concluding that no valid match exists. This exponential increase in computational complexity transforms what should be a millisecond operation into one that consumes significant CPU resources for an extended period.
The operational impact is severe due to the synchronous nature of the database drivers involved, specifically better-sqlite3 and sqljs. These libraries execute SQL queries, including those involving regular expression evaluations, directly on the main Node.js event loop thread. Because JavaScript in a single-threaded environment like Node.js relies on this loop for handling all incoming requests, any blocking operation prevents the server from processing other concurrent connections. Consequently, a single malicious request can block the entire application instance, rendering both the storefront and admin APIs unavailable to legitimate users. Furthermore, because the ShopProductsResolver endpoint is publicly accessible without authentication, an attacker does not need valid credentials to exploit this flaw. By sending repeated requests with these crafted patterns, an adversary can sustain a denial of service condition that effectively takes down the e-commerce platform until the server restarts or the malicious traffic ceases.
It is important to note that this vulnerability is database-specific in its impact mechanism. Deployments utilizing PostgreSQL or MySQL and MariaDB are not affected by this specific exploitation vector because these databases typically execute regular expression operations within their own separate processes or threads, rather than on the Node.js event loop. Therefore, while the input validation flaw exists across all supported backends, only those using SQLite-based drivers via better-sqlite3 or sqljs experience the synchronous blocking behavior that leads to service unavailability. This distinction highlights how architectural choices in database integration can significantly alter the risk profile of a code-level vulnerability.
The recommended mitigation is straightforward and immediate: upgrade Vendure to version 3.6.5 or later, where this issue has been resolved through improved input validation and pattern sanitization logic within the list query builder. For organizations unable to patch immediately due to dependency constraints, implementing a Web Application Firewall with rules capable of detecting and blocking regular expression patterns known for catastrophic backtracking can provide temporary relief. Additionally, deploying rate limiting on public GraphQL endpoints may help mitigate sustained denial-of-service attempts by throttling high-frequency requests from single sources. Long-term remediation should also involve adopting secure coding practices that validate and sanitize all user inputs before they are passed to sensitive functions, ensuring that even if similar flaws exist in other parts of the application, their exploitability is significantly reduced.