CLSA-2026-1793019970 TuxCare security update for @graphql-tools/utils (1 CVE)

TuxCare rebuilt @graphql-tools/utils to address 1 CVE. Fixed in 7.10.0-tuxcare.2...

CLSA-2026-1793018204 TuxCare security update for @graphql-tools/utils (1 CVE)

TuxCare rebuilt @graphql-tools/utils to address 1 CVE. Fixed in 8.9.0-tuxcare.1...

UBUNTU-CVE-2026-75507

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specifiedrules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation...

UBUNTU-CVE-2026-75508

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's maxtokens limit in Parser.advancelexer counts only non-comment tokens returned after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and...

CLSA-2026-1792937883 TuxCare security update for @graphql-tools/utils (1 CVE)

TuxCare rebuilt @graphql-tools/utils to address 1 CVE. Fixed in 6.0.9-tuxcare.1...

CVE-2026-115887

GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack exponentially when a PhoneNumber value contains a run of digits...

CVE-2026-115887 graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service

GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack exponentially when a PhoneNumber value contains a run of digits...

CVE-2026-115887 graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service

GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack exponentially when a PhoneNumber value contains a run of digits...

CVE-2026-115887

GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack exponentially when a PhoneNumber value contains a run of digits...

CVE-2026-115887 graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service

GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack exponentially when a PhoneNumber value contains a run of digits...

@webiny/ai-chat (>=6.6.0-alpha.1, <=6.6.0-alpha.4), @webiny/ai-powerups (>=0.0.0-unstable.33e4fd9647, <=6.6.0-alpha.9) +103 more potentially affected by CVE-2026-115887 via graphql-scalars (2.0.0)

graphql-scalars NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on graphql-scalars and may be impacted: - @webiny/ai-chat =6.6.0-alpha.1, =0.0.0-unstable.33e4fd9647, =0.0.0-unstable.33e4fd9647, =0.0.0-unstable.33e4fd9647,...

CVE-2026-115887

The graphql-scalars library contains a Regular Expression Denial of Service (ReDoS) vulnerability in the GraphQLPhoneNumber scalar (located in src/scalars/PhoneNumber.ts). Affected versions range from 1.24.1 until 2.0.1 . The root cause is the use of ambiguous nested digit quantifiers, which caus...

GraphQL-core: Denial Of Service Via Quadratic Complexity In The OverlappingFieldsCanBeMerged Validation Rule

Summary The "OverlappingFieldsCanBeMerged" validation rule can be driven into quadratic — and in the worst case "On²·m²" — running time by a small, highly compressible query. A single 364 KB document can occupy one CPU core for over five minutes during validation, before any resolver runs. Becaus...

GraphQL-core: Denial Of Service Via Comment Tokens Bypassing The Parser's Max_tokens Limit

Summary The parser's "maxtokens" limit — the documented defence against oversized GraphQL documents — did not count comment tokens. A document padded with comments could therefore pass a "maxtokens" check of any size while still allocating one "Token" object per comment, all of which stay reachab...

PT-2026-122234

Name of the Vulnerable Software and Affected Versions GraphQL Scalars versions 1.24.1 through 2.0.0 Description The GraphQLPhoneNumber scalar in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers. This causes exponential backtracking when a value contains a sequence of digits...

Hive GraphQL-Scalars resource management error vulnerability

Versions 1.24.1 through 2.0.1 of Hive GraphQL-Scalars contain a resource management error vulnerability. This vulnerability stems from the use of vague nested numeric quantifiers in GraphQLPhoneNumber within src/scalars/PhoneNumber.ts. When a phone number value contains a sequence of digits...

Linux Distros Unpatched Vulnerability : CVE-2026-75507

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in...

Linux Distros Unpatched Vulnerability : CVE-2026-75508

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's maxtokens limit in...

CVE-2026-75507

A flaw was found in GraphQL-core. An unauthenticated remote attacker could cause a Denial of Service DoS by submitting a specially crafted query with nested inline fragments. During query validation, repeated field comparisons consume excessive CPU resources before complexity limits can be...

CVE-2026-75508

A flaw was found in graphql-core. The parser's token limit improperly tracks only non-comment tokens while continuing to allocate and retain memory for skipped comments. An unauthenticated remote attacker could exploit this vulnerability by submitting a specially crafted, comment-padded GraphQL...