GraphQL Scalars includes a PhoneNumber scalar that incorporates a regular expression with ambiguous nested digit quantifiers. During validation or variable binding, the regex backtracks exponentially when a numeric run is followed by a character that fails to match, which can stall the Node.js event loop and effectively deny service. This occurs in a small unauthenticated request before any authentication checks, allowing any attacker to target the application. The vulnerability is classified as CWE‑1333.

The affected product is the graphql-hive graphql-scalars library. Versions from 1.24.1 up through 2.0.0 (any release prior to the 2.0.1 fix) are vulnerable. After upgrading to v2.0.1 or later, the issue is resolved.

The CVSS score of 7.5 indicates a high severity vector for a denial‑of‑service attack. Although no EPSS score is available, the exploit is straightforward: an unauthenticated user can submit a GraphQL request containing a long numeric sequence that triggers the backtracking, causing the server’s event loop to block. The exploit does not require privileged access and can be performed against any publicly exposed GraphQL endpoint that uses the vulnerable scalar. The vulnerability is not listed in the CISA KEV catalog, but the impact on availability makes it a critical concern for services that rely on this library.