Read the docs
TI-2026-45228 Aliases CVE-2026-63460GHSA-jgm3-qmp2-c4p7

Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends

Priority HIGH 72CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1333.

Summary

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically backtracking pattern through StringOperators.regex. packages/core/src/service/helpers/list-query-builder/parse-filter-params.ts passes the raw pattern to the REGEXP implementation registered by packages/core/src/service/helpers/list-query-builder/list-query-builder.ts, and better-sqlite3 and sqljs evaluate it synchronously in the Node.js event loop. ShopProductsResolver.products is publicly reachable, so one nested-quantifier pattern can block request processing and make the storefront and admin API unavailable, while repeated requests can sustain denial of service. PostgreSQL and MySQL or MariaDB deployments do not execute this regular expression in the Node.js event loop. This issue is fixed in version 3.6.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00609 49th percentileScored 2026-11-07
Fix Fixed vendure (vendurehq): 3.6.5@vendure/core (npm): 3.6.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vendurehqvendurebefore 3.6.53.6.5Patch availableCNA
—@vendure/core (npm)before 3.6.53.6.5Patch availableGHSA-jgm3-qmp2-c4p7
  • vendure Vendorvendurehq Affected before 3.6.5 Fixed in 3.6.5 Patch available CNA
  • @vendure/core (npm) Vendor— Affected before 3.6.5 Fixed in 3.6.5 Patch available GHSA-jgm3-qmp2-c4p7

Remediation

  • Fix · CNA vendure (vendurehq) Fixed in 3.6.5
  • Fix · GHSA-jgm3-qmp2-c4p7 @vendure/core (npm) Fixed in 3.6.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-63460
  2. 2026-10-03 Alias added: GHSA-jgm3-qmp2-c4p7

References

Advisory 1

Other 4

  • TI-2026-45233 Improper authentication in vendurehq vendure CVSS 3.1CRITICAL 9.1
  • TI-2026-45227 Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions CVSS 3.1HIGH 8.7
  • TI-2026-47643 Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Update CVSS 4.0MEDIUM 6.1
  • TI-2026-29543 @vendure/core has a SQL Injection vulnerability CVSS 3.1CRITICAL 9.1
  • TI-2026-45229 Vendure: Shop API list queries can return non-public entities when filterOperator is OR CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences