Threat database

A high-severity vulnerability (CVE-2026-115887) exists in the graphql-scalars library used by graphql-hive, specifically in the GraphQLPhoneNumber scalar between versions 1.24.1 and before 2.0.1. The issue is caused by inefficient regular expression complexity leading to exponential backtracking when parsing certain phone number inputs. This can block the Node.js event loop and stall the server, resulting in a denial of service. The vulnerability affects parseLiteral, parseValue, and serialize functions. It is fixed in version 2.0.1.

CVE-2026-23735 is a high-severity race condition vulnerability in graphql-hive's graphql-modules versions 2.2.1 to before 2.4.1 and 3.0.0 to before 3.1.1. The flaw occurs when multiple parallel requests trigger the same service, causing request contexts—often containing sensitive authentication tokens—to be mixed up due to improper synchronization in the @ExecutionContext() injection.

EPSS 0.6%Vulnerabilitygraphql-hive#cwe-362Germany+9