CVE-2026-63460 Details
Description
Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically backtracking pattern through StringOperators.regex. packages/core/src/service/helpers/list-query-builder/parse-filter-params.ts passes the raw pattern to the REGEXP implementation registered by packages/core/src/service/helpers/list-query-builder/list-query-builder.ts, and better-sqlite3 and sqljs evaluate it synchronously in the Node.js event loop. ShopProductsResolver.products is publicly reachable, so one nested-quantifier pattern can block request processing and make the storefront and admin API unavailable, while repeated requests can sustain denial of service. PostgreSQL and MySQL or MariaDB deployments do not execute this regular expression in the Node.js event loop. This issue is fixed in version 3.6.5.
A denial-of-service vulnerability has been identified in Vendure, an open-source headless commerce platform, in versions prior to 3.6.5. The issue arises in the public Shop GraphQL API, where an unauthenticated user can submit a regex pattern that causes catastrophic backtracking. This pattern is processed by the SQLite database driver in a synchronous manner, blocking the Node.js event loop and causing the storefront and admin API to become unresponsive. The vulnerability affects only SQLite-backed instances, which are typically used for development and testing, while production deployments on PostgreSQL or MySQL/MariaDB are not impacted.
Upgrade to Vendure version 3.6.5 or later, where this vulnerability has been addressed. The update includes improved input validation for regex filters, preventing the submission of patterns that could cause excessive resource consumption.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vendurehq/vendure/security/advisories/GHSA-jgm3-qmp2-c4p7 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/vendurehq/vendure/commit/f74cbbb0b9a50b5b0131822835fe7ee9b71b42c9 | [email protected] | Source CodeVendor |
| https://github.com/vendurehq/vendure/releases/tag/v3.6.5 | [email protected] | Release NotesVendor |
| https://github.com/vendurehq/vendure/security/advisories/GHSA-jgm3-qmp2-c4p7 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1333 | Inefficient Regular Expression Complexity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vendure | <= 3.6.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |