CVE-2026-115887

GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack exponentially when a PhoneNumber value contains a run of digits followed by a character that makes the match fail. GraphQL evaluates parseLiteral during document validation and parseValue during variable coercion before resolver authentication or authorization, so a small unauthenticated request can block the Node.js event loop and stall the server process. serialize is also affected when unvalidated stored values are returned through the scalar. This issue is fixed in version 2.0.1.

• CWE-1333

• https://github.com/graphql-hive/graphql-scalars/commit/210fd2485641afa2452800c00144245c74361701
• https://github.com/graphql-hive/graphql-scalars/pull/2719
• https://github.com/graphql-hive/graphql-scalars/releases/tag/v2.0.1
• https://github.com/graphql-hive/graphql-scalars/security/advisories/GHSA-x8rm-f576-gq67

Published

Oct 23, 2026

Last Modified

Oct 23, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-115863ConnMan through 2.0 has a stack-based buffer overflow via a …7.6
• CVE-2026-115877Twisted is an event-based framework for internet application…5.4
• CVE-2026-11588The EONSR AEO Agent WordPress plugin through 3.7.9 does not …6.1
• CVE-2026-115883LangGraph checkpoint savers provide Postgres- and SQLite-bac…6
• CVE-2026-115885The LangGraph CLI is the official command-line interface for…4.1
• CVE-2026-115886MLflow is an open source AI engineering platform for agents,…6.5
• CVE-2026-115889Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and …9.9
• CVE-2026-11589The WP Support Plus Responsive Ticket System WordPress plugi…8.8
• CVE-2026-115892Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.…5.7
• CVE-2026-115893Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.…9.9
• CVE-2026-115895Happy DOM is a JavaScript implementation of a web browser wi…8.8
• CVE-2026-115897Serialize JavaScript serializes JavaScript values to a super…2.1