CVE-2026-115887

graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service

Denial of service. Any GraphQL server that exposes PhoneNumber on an argument, an input object field or a variable can be stalled by a request of about 30 characters; roughly 40 characters would keep a process busy for hours (extrapolated from the doubling, not measured). serialize uses the same regex, so unvalidated stored values returned through a PhoneNumber field are affected too. The actual severity depends on the scalar being applied to untrusted input, which is the typical case.

A regular expression with worst-case exponential or polynomial matching time is applied to untrusted input, causing excessive CPU use. Typical impact: denial of service when input is crafted to trigger backtracking.

CVE-2026-115887 has a CVSS score of 7.5 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2.0.1); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

An equivalent pattern without ambiguous splits:

const PHONE_NUMBER_REGEX = /^\+?\d{1,3}[- ]?\(?\d(?:\d*\))?(?:[- ]?\d)+$/;

It accepts exactly the same strings as the current one, so there is no behaviour change: with N = (S?\d+)+ = (S?\d)+ a digit run is just repeated single-digit iterations, hence \d+\)?N = \d(\d*\))?N. Verification:

• exhaustive comparison of old and new pattern on every string up to length 9 over 1 + - space ( ) x: 47,079,208 strings (1,832 accepted), 0 differences;
• every sequence of up to 6 tokens from 1 11 111 1111 11111 + - space ( ) x: 1,948,717 strings (100,380 accepted), 0 differences;
• adversarial inputs (digit runs plus a failing character, digit/space and digit/dash alternations, parenthesis variants) scale linearly: 1,000,000 characters take about 10 ms, where the current pattern needs 0.3 s for 26.

Optionally also reject values above a sane length before matching; the grammar currently has no upper bound and E.164 allows at most 15 digits. Above roughly 10 million characters V8 aborts the match with a RangeError (stack) after about 25 ms instead of returning false.

A regression test that fails with the current implementation: GraphQLPhoneNumber.parseValue('1'.repeat(40) + 'x') must throw its validation error immediately; with the current pattern it does not return in any reasonable time.

1. What is CVE-2026-115887? CVE-2026-115887 is a high-severity inefficient regular expression (ReDoS) vulnerability in graphql-scalars (npm), affecting versions >= 1.24.1, <= 2.0.0. It is fixed in 2.0.1. A regular expression with worst-case exponential or polynomial matching time is applied to untrusted input, causing excessive CPU use.
2. How severe is CVE-2026-115887? CVE-2026-115887 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of graphql-scalars are affected by CVE-2026-115887? graphql-scalars (npm) versions >= 1.24.1, <= 2.0.0 is affected.
4. Is there a fix for CVE-2026-115887? Yes. CVE-2026-115887 is fixed in 2.0.1. Upgrade to this version or later.
5. Is CVE-2026-115887 exploitable, and should I be worried? Whether CVE-2026-115887 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-115887 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-115887? Upgrade graphql-scalars to 2.0.1 or later.