Ambiguous Nested Digit Quantifiers in GraphQL Scalars Affecting GraphQLPhoneNumber

CVE-2026-115887

What is CVE-2026-115887?

The GraphQL Scalars library, specifically affecting the GraphQLPhoneNumber scalar, presents a vulnerability due to the use of ambiguous nested digit quantifiers. This flaw can cause exponential backtracking when processing PhoneNumber values that include a sequence of digits followed by a character that disrupts the match. As a result, it can lead to significant performance degradation by blocking the Node.js event loop during document validation and variable coercion, halting server processes even for small unauthenticated requests. Moreover, the serialize function is also compromised when unvalidated stored values are returned, making this issue critical to address. The issue has been resolved in version 2.0.1.

References