CVE-2026-115887: graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service
(updated )
The regular expression behind GraphQLPhoneNumber since 1.24.1 backtracks exponentially. A string made of a run of digits followed by one character that makes the match fail (for example "1".repeat(30) + "x") blocks the JavaScript thread for seconds, and every additional digit doubles the time.
graphql-js calls parseLiteral while validating a document and parseValue while coercing variables, so the regex runs for every request that merely contains such a value in a PhoneNumber position, before execution and before any authentication or authorization step of the server. One small unauthenticated request is enough to stall a server process.
References
- github.com/advisories/GHSA-x8rm-f576-gq67
- github.com/graphql-hive/graphql-scalars/commit/210fd2485641afa2452800c00144245c74361701
- github.com/graphql-hive/graphql-scalars/pull/2719
- github.com/graphql-hive/graphql-scalars/releases/tag/v2.0.1
- github.com/graphql-hive/graphql-scalars/security/advisories/GHSA-x8rm-f576-gq67
- nvd.nist.gov/vuln/detail/CVE-2026-115887
Code Behaviors & Features
Detect and mitigate CVE-2026-115887 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →