CVE-2026-63460 is an inefficient regular expression complexity vulnerability (CWE-1333) in vendurehq's Vendure platform before version 3.6.5. The public Shop GraphQL API allows unauthenticated callers to provide a regex pattern via StringOperators.regex that is passed directly to the REGEXP implementation evaluated synchronously in Node.js. Specifically, the vulnerable code paths are in parse-filter-params.ts and list-query-builder.ts, with better-sqlite3 and sqljs performing synchronous regex evaluation. A nested-quantifier pattern can cause catastrophic backtracking, blocking the Node.js event loop and denying service. Deployments using PostgreSQL or MySQL/MariaDB are not affected by this synchronous evaluation issue. The vulnerability is fixed in Vendure 3.6.5.

An unauthenticated attacker can cause a denial of service by submitting a crafted regex pattern that triggers catastrophic backtracking, blocking the Node.js event loop and making the storefront and admin API unavailable. This affects deployments using better-sqlite3 or sqljs for database backends. There is no impact on confidentiality or integrity, and deployments using PostgreSQL or MySQL/MariaDB are not affected by this issue.

Upgrade Vendure to version 3.6.5 or later, where this vulnerability is fixed. No other mitigations are indicated by the vendor advisory. If upgrading is not immediately possible, consider using PostgreSQL or MySQL/MariaDB as the database backend, which do not evaluate the regex in the Node.js event loop and thus are not vulnerable to this issue.