CVE-2026-115887
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Oct 23, 2026
CISA due date
—
The record
GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack exponentially when a PhoneNumber value contains a run of digits followed by a character that makes the match fail. GraphQL evaluates parseLiteral during document validation and parseValue during variable coercion before resolver authentication or authorization, so a small unauthenticated request can block the Node.js event loop and stall the server process. serialize is also affected when unvalidated stored values are returned through the scalar. This issue is fixed in version 2.0.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-62864 Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack. CWE-1333
- CVE-2026-119300 Wekan is open source kanban built with Meteor. CWE-1333
- CVE-2026-118993 CallBackery versions before 0.62.0 for Perl allow denial of service via the request path… CWE-1333
- CVE-2026-115866 Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular… CWE-1333
- CVE-2026-119202 @hapi/content provides HTTP Content-* header parsing. CWE-1333
- CVE-2026-118779 Forge (also called node-forge) is a native implementation of Transport Layer Security in… CWE-1333
- CVE-2026-118772 joi is a schema description language and data validator for JavaScript. CWE-1333
- CVE-2026-118686 EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability… CWE-1333