Vendure CVE-2026-63460

Exploitable only when the Vendure instance runs on the better-sqlite3 or sqljs database driver, which register a synchronous JavaScript REGEXP UDF evaluated on the Node.js event loop; deployments on PostgreSQL or MySQL/MariaDB are NOT exploitable because the pattern is delegated to the database engine. Given a SQLite backend, no other conditions apply: the ShopProductsResolver.products query has no @Allow decorator and the default access-control strategy treats an empty permission set as public, so exploitation is remote and fully unauthenticated with no user interaction, using a filter like {regex: '(a+)+$'}. The primary limiting factor is that SQLite is typically a development/testing backend rather than production, sharply narrowing the exposed population.

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a clean unauthenticated, network-reachable, low-complexity availability-only impact, which matches the description: the ShopProductsResolver.products query carries no @Allow decorator and is publicly reachable, and a single nested-quantifier pattern via StringOperators.regex blocks the Node.js event loop. However, the raw 7.5 significantly overstates real-world priority because exploitation is strictly gated on the SQLite driver (better-sqlite3 or sqljs), which the vendor explicitly notes is normally a development/testing backend - production deployments on PostgreSQL or MySQL/MariaDB delegate the regex to the database engine and are unaffected. No EPSS score, no CISA KEV listing, and no formally published exploit are present in the provided data, so there is no public exploit identified at time of analysis; the availability signal is real but the deployment gating makes this a lower operational priority than the score implies. Note also the input Tags include 'PostgreSQL', which is the explicitly UNAFFECTED database - a potentially misleading label. Confidence in the technical mechanism is high because vendor source code (the SQLite UDF at list-query-builder.ts) and the fixing commit are provided.

An attacker sends an unauthenticated GraphQL query to the public Shop API's products resolver with a filter such as {regex: '(a+)+$'} against a string field, only effective if the target runs the better-sqlite3 or sqljs driver. The synchronous SQLite REGEXP user-defined function evaluates the catastrophically backtracking pattern on the Node.js event loop, freezing all request processing; repeated requests sustain a complete denial of service of both storefront and admin APIs. No standalone weaponized exploit is published, though the fix's own test suite demonstrates the trigger pattern.