Graphql Scalars
Monthly
Denial of service in the GraphQLPhoneNumber scalar of the graphql-scalars npm package (versions 1.24.1 through 2.0.0) lets an unauthenticated remote client stall a Node.js server process with a single request of roughly 30 characters placed in any PhoneNumber-typed argument, input-object field or variable. The scalar's regex backtracks exponentially on a run of digits followed by a failing character, and graphql-js runs parseLiteral during document validation and parseValue during variable coercion before any resolver authentication or authorization, so the work happens even on requests that would ultimately be rejected. The advisory (GHSA-x8rm-f576-gq67) includes a reproduction script with measured timings and the maintainers have released version 2.0.1 with a linear-time pattern; there is no CISA KEV listing, and the preconditions are limited to schemas that actually expose this scalar on attacker-controllable input.
Denial of service in the GraphQLPhoneNumber scalar of the graphql-scalars npm package (versions 1.24.1 through 2.0.0) lets an unauthenticated remote client stall a Node.js server process with a single request of roughly 30 characters placed in any PhoneNumber-typed argument, input-object field or variable. The scalar's regex backtracks exponentially on a run of digits followed by a failing character, and graphql-js runs parseLiteral during document validation and parseValue during variable coercion before any resolver authentication or authorization, so the work happens even on requests that would ultimately be rejected. The advisory (GHSA-x8rm-f576-gq67) includes a reproduction script with measured timings and the maintainers have released version 2.0.1 with a linear-time pattern; there is no CISA KEV listing, and the preconditions are limited to schemas that actually expose this scalar on attacker-controllable input.