ZDF
Sign inSign up

Vulnerabilities

Security research · CVE-2026-115887

graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service

Published Oct 28, 2026 · catalog updated Oct 28, 2026 · graphql-scalars PhoneNumber scalar is

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-115887. EPSS is 0.49%. Act only if a listed version of graphql-scalars PhoneNumber scalar is is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (graphql-scalars PhoneNumber scalar is).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.49%
Remediation
Version ranges on file
Affected products
npm graphql-scalars

## Summary The regular expression behind since 1.24.1 backtracks exponentially. A string made of a run of digits followed by one character that makes the match fail (for example ) blocks the JavaScript thread for seconds, and every additional digit doubles the time. graphql-js calls while *validating* a document and while coercing variables, so the regex runs for every request that merely contains such a value in a position, before execution and before any authentication or authorization step of the server. One small unauthenticated request is enough to stall a server process. ## Affected versions - >= 1.24.1, <= 2.0.0 (2.0.0 is the current ; the default branch still has the same pattern). - Not affected: 1.24.0 and the earlier versions I checked (1.22.4, 1.23.0), which use the linear . - Introduced by #2719 (c7f58da16, "PhoneNumber scalar is not fully compatible with E.164 format so updated regex to support phone number with extension"), released as 1.24.1 on 2025-01-29. The payload was ran against 1.22.4, 1.23.0, 1.24.0, 1.24.1, 1.24.2, 1.25.0, 1.26.0 and 2.0.0: the first three reject it instantly, the other five show the exponential growth. ## Root cause : In the separator is optional, so a run of n digits can be split across the inner and the outer iterations in a number of ways that is exponential in n. When the overall match fails, for instance on a trailing non-digit, the engine tries all of them. ## Proof of concept 1. The scalar alone ( ): Measured warm, i.e. after ordinary inputs have been validated like in a running server: | digits | Node 22.19.0 | Node 26.10.0 | |-------:|-------------:|-------------:| | 24 | 0.10 s | 0.07 s | | 26 | 0.41 s | 0.29 s | | 28 | 1.63 s | 1.14 s | | 30 | 6.59 s | 4.62 s | The time doubles with every digit. The first execution of the regex in a fresh process is about 5x slower because V8 interprets a regexp on its first run (Node 22.19.0, 28 digits: 7.8 s). 2. Through graphql-js, no server and no authentication: a schema with

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm graphql-scalars<= 2.0.0

How to fix CVE-2026-115887

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-115887. EPSS is 0.49%. Act only if a listed version of graphql-scalars PhoneNumber scalar is is installed.

Which versions are affected?

Compare what you have installed with <= 2.0.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-1333: Inefficient Regular Expression Complexity. EPSS 0.49%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 28, 2026 · GitHub Advisory Database

    Detected

    ## Summary The regular expression behind since 1.24.1 backtracks exponentially. A string made of a run of digits followed by one character that makes the match fail (for example ) blocks the JavaScript thread for seconds, and every additional digit doubles the time. graphql-js calls while *validating* a document and while coercing variables, so the regex runs for every request that merely contains

  2. Oct 28, 2026 · GitHub Advisory Database

    Updated

    ## Summary The regular expression behind since 1.24.1 backtracks exponentially. A string made of a run of digits followed by one character that makes the match fail (for example ) blocks the JavaScript thread for seconds, and every additional digit doubles the time. graphql-js calls while *validating* a document and while coercing variables, so the regex runs for every request that merely contains

Sources

  • CVE.orgVulnerability recordCVE-2026-115887

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-115887

    30-day exploitation probability 0.49%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-x8rm-f576-gq67

    graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-115887

    The regular expression behind GraphQLPhoneNumber since 1.24.1 backtracks exponentially. A string made of a run of digits followed by one character that makes the match fail (for example "1".repeat(30) + "x") blocks the JavaScript thread for seconds, and every additional digit doubles the time. graphql-js calls parseLiteral while validating a document and parseValue while coercing variables, so the

    advisories.gitlab.com

References

Freshness

Last verified in this catalog Nov 5, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSNov 5, 2026
  • GitLab Advisory DatabaseOct 30, 2026
  • CVE.orgOct 29, 2026
  • GitHub Advisory DatabaseOct 29, 2026