CVE-2026-115887 with a CVSS score of 7.5 is a regular expression denial of service vulnerability in the PhoneNumber scalar of the graphql-scalars package, affecting versions "graphql-scalars >= 1.24.1, <= 2.0.0". The flaw is an inefficient regular expression used by the GraphQLPhoneNumber scalar when parsing or validating phone number values, causing exponential backtracking when a long digit run is followed by a character that makes the match fail. An unauthenticated attacker can exploit it by sending a small GraphQL request that places such a value in a PhoneNumber argument, input object field, or variable, because graphql-js runs parseLiteral during document validation and parseValue during variable coercion before execution and before authentication or authorization checks. A request containing roughly thirty characters can stall the JavaScript thread for seconds, and longer inputs can keep a process busy for much longer, potentially blocking concurrent requests. The business impact is denial of service for any GraphQL server that exposes the PhoneNumber scalar on untrusted input, including public endpoints, because the vulnerable processing occurs early in request handling and can degrade or interrupt service availability.
We recommend you to update graphql-scalars to version 2.0.1.[/subscribe_to_unlock_form]
CVE-2026-115887 with a CVSS score of 7.5 is a regular expression denial of service vulnerability in the PhoneNumber scalar of the graphql-scalars package, affecting versions "graphql-scalars >= 1.24.1, <= 2.0.0". The flaw is an inefficient regular expression used by the GraphQLPhoneNumber scalar when parsing or validating phone number values, causing exponential backtracking when a long digit run is followed by a character that makes the match fail. An unauthenticated attacker can exploit it by sending a small GraphQL request that places such a value in a PhoneNumber argument, input object field, or variable, because graphql-js runs parseLiteral during document validation and parseValue during variable coercion before execution and before authentication or authorization checks. A request containing roughly thirty characters can stall the JavaScript thread for seconds, and longer inputs can keep a process busy for much longer, potentially blocking concurrent requests. The business impact is denial of service for any GraphQL server that exposes the PhoneNumber scalar on untrusted input, including public endpoints, because the vulnerable processing occurs early in request handling and can degrade or interrupt service availability.
We recommend you to update graphql-scalars to version 2.0.1.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]