CVE-2026-115887 | graphql-hive graphql-scalars prior 2.0.1 PhoneNumber PhoneNumber.ts parseLiteral/parseValue/serialize redos

October 23, 2026 Yanac

A vulnerability has been found in graphql-hive graphql-scalars and classified as problematic. The impacted element is the function parseLiteral/parseValue/serialize of the file src/scalars/PhoneNumber.ts of the component PhoneNumber. This manipulation of the argument PhoneNumber causes inefficient regular expression complexity.

This vulnerability is tracked as CVE-2026-115887. The attack is possible to be carried out remotely. No exploit exists.

The affected component should be upgraded.VulDB Recent EntriesRead More