Executive brief
Vendure is an open-source e-commerce framework that uses GraphQL APIs to power online storefronts. When deployed with SQLite databases (common in development and small single-server setups), an attacker can send a specially crafted product filter query containing a malicious regex pattern. This triggers catastrophic backtracking in the JavaScript regex engine, blocking the server's main event loop for tens of seconds and rendering the entire storefront and admin panel unresponsive. No authentication or credentials are required to launch this attack.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) in the public GraphQL `products` query filtering mechanism. Vendure registers a synchronous SQLite user-defined function (UDF) that evaluates the `StringOperators.regex` filter parameter directly as a JavaScript RegExp without any validation, length limits, or safe-regex checks. The vulnerable code is in `list-query-builder.ts` lines 917–931, where user-supplied regex patterns are passed directly to `new RegExp(pattern)` and evaluated on the Node.js event loop. The `products` resolver carries no authentication decorator, making it publicly accessible. A 29-character pattern like `(a+)+
Affected products
- Vendure Vendure Core <= 3.6.4
Timeline
- 2026-09-17: disclosed: Advisory published to GitHub Advisory Database
- 2026-09-17: patched: Patch released in version 3.6.5