AIKIDO-2026-50100
@vendure/core is vulnerable to Regular Expression Denial of Service (ReDoS)
75
High Risk
This Affects:
@vendure/coreTL;DR
The Shop GraphQL API exposes a string regex list filter whose pattern is compiled into a RegExp and executed inside a SQLite user-defined function on the Node.js event loop without validation or a length limit. An unauthenticated caller can submit a catastrophically backtracking pattern that makes the server unresponsive. The fix validates the pattern, enforces a maximum length, and moves regex execution off the event loop with timeout protection.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run Vendure on a SQLite database backend where the Shop API exposes the string regex list filter.
Background info
@vendure/core is vulnerable to Regular Expression Denial of Service (ReDoS) in versions 0.17.0 - 3.6.4.
How to fix this
Upgrade the @vendure/core library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.