graphql-hive CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH graphql-hive CVE published 2026-10-23

CVE-2026-115887

CVE-2026-115887 graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service, allowing unauthenticated requests to stall the Node.js event loop and server process. GraphQL API administrators and developers using graphql-scalars versions between 1.24.1 and 2.0.1 should assess exposure and prioritize remediation. The issue is fixed in version 2.0.1, and updating to this version o [truncated]