https://feed.craftedsignal.io/vendors/graphql-scalars/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 24 Oct 2026 00:03:00 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-10-graphql-scalars-redos/Sat, 24 Oct 2026 00:03:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-graphql-scalars-redos/The GraphQLPhoneNumber scalar in the GraphQL Scalars library uses ambiguous nested digit quantifiers that backtrack exponentially, allowing unauthenticated requests to block the Node.js event loop and stall the server process.CVE-2026-115887 involves a vulnerability in src/scalars/PhoneNumber.ts within the GraphQL Scalars library. The scalar uses ambiguous nested digit quantifiers that cause exponential backtracking when a value contains a sequence of digits followed by a character that triggers a match failure. Because this occurs during document validation (parseLiteral) or variable coercion (parseValue) before authentication or authorization, unauthenticated requests can block the Node.js event loop. The serialize function is also affected.

]]>lowadvisory