CVE-2026-63460: Vendure unauthenticated ReDoS in regex filter on SQLite

CVE-2026-63460 · Severity: high · CVSS 7.5 · Published 2026-09-17

Vendure is an open-source e-commerce framework that uses GraphQL APIs to power online storefronts. When deployed with SQLite databases (common in development and small single-server setups), an attacker can send a specially crafted product filter query containing a malicious regex pattern. This triggers catastrophic backtracking in the JavaScript regex engine, blocking the server's main event loop for tens of seconds and rendering the entire storefront and admin panel unresponsive. No authentication or credentials are required to launch this attack.

Technologies: @vendure/core (npm). Vendors: npm.

Quick answers

Is CVE-2026-63460 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63460 being exploited in the wild.
How severe is CVE-2026-63460?
High severity, with a CVSS score of 7.5, published 17 September 2026.
Which products and versions are affected?
@vendure/core (npm) <= 3.6.4, SEMVER:introduced=0,fixed=3.6.5.
Is there a fix for CVE-2026-63460?
Yes. @vendure/core (npm): upgrade to 3.6.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63460 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-63460?
Check whether you run @vendure/core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @vendure/core (npm): upgrade to 3.6.5 or later
    npm install @vendure/core@3.6.5

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) in the public GraphQL `products` query filtering mechanism. Vendure registers a synchronous SQLite user-defined function (UDF) that evaluates the `StringOperators.regex` filter parameter directly as a JavaScript RegExp without any validation, length limits, or safe-regex checks. The vulnerable code is in `list-query-builder.ts` lines 917–931, where user-supplied regex patterns are passed directly to `new RegExp(pattern)` and evaluated on the Node.js event loop. The `products` resolver carries no authentication decorator, making it publicly accessible. A 29-character pattern like `(a+)+$` causes ~20 seconds of CPU spin. Affected database drivers are `better-sqlite3` and `sqljs` (MySQL/MariaDB and PostgreSQL are unaffected because they delegate regex processing to their own engines). The patch is available in version 3.6.5 and includes regex validation, pattern length enforcement, and worker-thread isolation.

Affected products

  • Vendure Vendure Core <= 3.6.4

Identifiers

  • CVE-2026-63460
  • GHSA-jgm3-qmp2-c4p7

Timeline

  • 2026-09-17: disclosed: Advisory published to GitHub Advisory Database
  • 2026-09-17: patched: Patch released in version 3.6.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.