GraphQL Scalars: ReDoS via GraphQLPhoneNumber (CVE-2026-115887)
The GraphQLPhoneNumber scalar in the GraphQL Scalars library uses ambiguous nested digit quantifiers that backtrack exponentially, allowing unauthenticated requests to block the Node.js event loop and stall the server process.
CVE search metadata
CVE search record: CVE-2026-115887. Severity: high. CVSS: 7.5. EPSS: 0.41%. KEV: no. Brief: GraphQL Scalars: ReDoS via GraphQLPhoneNumber (CVE-2026-115887). Brief link: https://feed.craftedsignal.io/briefs/2026-10-graphql-scalars-redos/
Triage facts
Revision 2- Evidence
- Unknown
- Severity
- Low
- Sources
- 2 public sources
- Freshness
- Revision 2Oct 29, 00:15 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Revision history 1 entry · Revision 2
- Revision 2
poc_available
Changed: affected_vendors, claim_state, cves, has_poc, lastmod, references, updates
Sources: 1
CVE-2026-115887 involves a vulnerability in src/scalars/PhoneNumber.ts within the GraphQL Scalars library. The scalar uses ambiguous nested digit quantifiers that cause exponential backtracking when a value contains a sequence of digits followed by a character that triggers a match failure. Because this occurs during document validation (parseLiteral) or variable coercion (parseValue) before authentication or authorization, unauthenticated requests can block the Node.js event loop. The serialize function is also affected.