graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service
Résumé
GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack exponentially when a PhoneNumber value contains a run of digits foll...
Résumé IA
Rédigé par une IA externe ; il peut contenir des erreurs. Vérifiez la description d'origine et les références ci-dessous avant d'agir.
graphql-scalars の PhoneNumber スカラーに、正規表現の処理が極端に長くなる脆弱性(CWE-1333)が見つかりました。バージョン 1.24.1 から 2.0.1 未満が対象で、認証前の小さなリクエストでもNode.js のイベントループが止まり、サーバーが応答しなくなるおそれがあります。 修正版は 2.0.1 です。速やかに 2.0.1 以降へ更新してください。
Paquets affectés
| Écosystème | Paquet | Concernées | Corrigé |
|---|---|---|---|
| graphql-hive | graphql-scalars | — | — |
Description d'origine La description telle que publiée par la source (souvent en anglais).
GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack exponentially when a PhoneNumber value contains a run of digits followed by a character that makes the match fail. GraphQL evaluates parseLiteral during document validation and parseValue during variable coercion before resolver authentication or authorization, so a small unauthenticated request can block the Node.js event loop and stall the server process. serialize is also affected when unvalidated stored values are returned through the scalar. This issue is fixed in version 2.0.1.
Source: CVE.org (CVE Program・cvelistV5) NVD