CVE-2026-115887: CWE-1333: Inefficient Regular Expression Complexity in graphql-hive graphql-scalars

The graphql-scalars library's GraphQLPhoneNumber scalar (versions >=1.24.1 <2.0.1) uses ambiguous nested digit quantifiers in its regular expressions, which cause exponential backtracking when a phone number input contains a run of digits followed by a character that causes the match to fail. Because GraphQL evaluates parseLiteral during document validation and parseValue during variable coercion before authentication or authorization, an unauthenticated attacker can send a small crafted request that blocks the Node.js event loop, stalling the server process. The serialize function is also affected when returning unvalidated stored values. This denial-of-service vulnerability is addressed in version 2.0.1.

An attacker can cause a denial of service by sending crafted GraphQL requests that trigger exponential backtracking in the regular expression used by the GraphQLPhoneNumber scalar. This stalls the Node.js event loop, effectively blocking the server from processing further requests. The vulnerability can be exploited without authentication due to the evaluation order of GraphQL parsing functions. There is no impact on confidentiality or integrity, only availability.

Upgrade graphql-scalars to version 2.0.1 or later, where this issue is fixed. No other mitigations are indicated by the vendor advisory. Patch status is confirmed fixed in 2.0.1.