Denial of Service Vulnerability in Vendure Headless Commerce Platform

CVE-2026-63460

What is CVE-2026-63460?

The Vendure headless commerce platform, prior to version 3.6.5, is susceptible to a denial of service (DoS) condition via its public Shop GraphQL API. An unauthenticated user can exploit this vulnerability by supplying a backtracking pattern through StringOperators.regex, leading to significant performance issues. This unauthorized input can cause the system to become unresponsive due to the synchronous execution of the regex operation within Node.js. Consequently, this can block request processing, making both storefront and admin API functionalities unavailable. It is important to note that this vulnerability does not affect PostgreSQL and MySQL or MariaDB deployments, which manage regex operations differently. The issue was resolved in version 3.6.5, where adequate measures were implemented to prevent such exploits.

References