Read the docs
TI-2026-80000 Aliases CVE-2026-115887GHSA-x8rm-f576-gq67

Regex backtracking in graphql-scalars PhoneNumber scalar

Priority HIGH 72CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1333.

Summary

The npm package graphql-scalars from 1.24.1 before 2.0.1 has a PhoneNumber scalar whose regular expression uses ambiguous nested digit quantifiers (CWE-1333). Certain values make the match backtrack exponentially. An unauthenticated remote attacker sends a small request that is parsed before authorization, blocking the Node.js event loop.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack exponentially when a PhoneNumber value contains a run of digits followed by a character that makes the match fail. GraphQL evaluates parseLiteral during document validation and parseValue during variable coercion before resolver authentication or authorization, so a small unauthenticated request can block the Node.js event loop and stall the server process. serialize is also affected when unvalidated stored values are returned through the scalar. This issue is fixed in version 2.0.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00487 42nd percentileScored 2026-11-07
Fix Fixed graphql-scalars (graphql-hive): 2.0.1graphql-scalars (npm): 2.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
graphql-hivegraphql-scalars1.24.1 to before 2.0.12.0.1Patch availableCNA
—graphql-scalars (npm)1.24.1 to before 2.0.12.0.1Patch availableGHSA-x8rm-f576-gq67
  • graphql-scalars Vendorgraphql-hive Affected 1.24.1 to before 2.0.1 Fixed in 2.0.1 Patch available CNA
  • graphql-scalars (npm) Vendor— Affected 1.24.1 to before 2.0.1 Fixed in 2.0.1 Patch available GHSA-x8rm-f576-gq67

Remediation

Upgrade graphql-scalars to version 2.0.1.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA graphql-scalars (graphql-hive) Fixed in 2.0.1
  • Fix · GHSA-x8rm-f576-gq67 graphql-scalars (npm) Fixed in 2.0.1 Advisory →

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-115887
  2. 2026-10-24 Priority changed: MEDIUM → LOW
  3. 2026-10-25 EPSS moved to the below the 50th percentile
  4. 2026-10-28 Alias added: GHSA-x8rm-f576-gq67
  5. 2026-10-28 Fix available: npm/[email protected] · GHSA-x8rm-f576-gq67
  6. 2026-10-28 CVSS score added · GHSA-x8rm-f576-gq67
  7. 2026-10-28 Weakness changed · GHSA-x8rm-f576-gq67
  8. 2026-10-28 6 new references · GHSA-x8rm-f576-gq67
  9. 2026-10-30 Affected versions changed · GHSA-x8rm-f576-gq67
  10. 2026-10-30 CISA SSVC decision points changed
  11. 2026-10-30 Priority changed: LOW → HIGH

References

Advisory 1

Other 5

  • TI-2026-19108 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in graphql-modules CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences