CVE-2026-115887 graphql-hive CVE debrief

Who should care

GraphQL API administrators and developers using graphql-scalars versions between 1.24.1 and 2.0.1 should assess exposure and prioritize remediation to prevent potential denial of service attacks.

Why it matters

CVE-2026-115887 graphql-scalars PhoneNumber scalar vulnerability requires attention from GraphQL API administrators and developers to assess exposure and prioritize remediation, as it can lead to denial of service attacks.

• Potential for unauthenticated denial of service
• Possible impact on Node.js event loop and server process
• Need for verification of affected versions and exposure
• Priority for updating graphql-scalars to version 2.0.1 or later

Technical summary

The graphql-scalars library's PhoneNumber scalar is vulnerable to regular expression denial of service due to ambiguous nested digit quantifiers. This can cause the Node.js event loop to stall and block the server process when a small unauthenticated request is made. The issue is fixed in version 2.0.1. GraphQL evaluates parseLiteral during document validation and parseValue during variable coercion before resolver authentication or authorization, making it possible for a small unauthenticated request to block the server process. serialize is also affected when unvalidated stored values are returned through the scalar.

Defensive priority

GraphQL API administrators and developers should prioritize assessing exposure and remediation due to potential for unauthenticated denial of service

Recommended defensive actions

• Assess exposure of GraphQL APIs using graphql-scalars versions between 1.24.1 and 2.0.1
• Verify if unauthenticated requests can cause denial of service
• Update graphql-scalars to version 2.0.1 or later
• Monitor for suspicious unauthenticated requests
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability in graphql-scalars' PhoneNumber scalar, which uses ambiguous nested digit quantifiers that can lead to exponential backtracking and denial of service. The issue is fixed in version 2.0.1.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.