CVE-2026-63460Patch

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically backtracking pattern through StringOperators.regex. packages/core/src/service/helpers/list-query-builder/parse-filter-params.ts passes the raw pattern to the REGEXP implementation registered by packages/core/src/service/helpers/list-query-builder/list-query-builder.ts, and better-sqlite3 and sqljs evaluate it synchronously in the Node.js event loop. ShopProductsResolver.products is publicly reachable, so one nested-quantifier pattern can block request processing and make the storefront and admin API unavailable, while repeated requests can sustain denial of service. PostgreSQL and MySQL or MariaDB deployments do not execute this regular expression in the Node.js event loop. This issue is fixed in version 3.6.5.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-1333

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 2 signals
Peaked 1d ago at 1 mentions (2026-09-17); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Patch

2100.0%

Referenced assets1 URL

By indicator

https://www.cve.org/CVERecord?id=CVE-2026-63460

Full discourse2 posts

DFIR Lab@DFIR_Lab33d
Patch
🚨 HIGH SEVERITY: CVE-2026-63460 (CVSS 7.5) Vendure e-commerce platform vulnerable to ReDoS attack via GraphQL API. Unauthenticated attackers can cause complete DoS. Affects: <3.6.5 (SQLite/sqljs) Patch NOW to 3.6.5 #CVE #Vulnerability #PatchNow https://t.co/7e2Xwqux7d
Post summary
The tweet highlights CVE-2026-63460, a ReDoS vulnerability in Vendure's GraphQL API affecting versions <3.6.5 (CVSS 7.5), and urges immediate patching to version 3.6.5.
0000030
144 followersView on X
CVE@CVEnew46d
Patch
CVE-2026-63460 Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically backtr… https://www.cve.org/CVERecord?id=CVE-2026-63460
Post summary
The text discloses CVE-2026-63460 in Vendure, detailing an unauthenticated GraphQL API vulnerability leading to catastrophic backtracking, and identifies version 3.6.5 as the patched release.
000001.6K
58.1K followersView on X

Explore more

Back to dashboard