{"action":"Upgrade @vendure/core to 3.6.5 or later.","affected":[{"fixed":"3.6.5","introduced":"0"}],"component":"@vendure/core","cve_ids":["CVE-2026-63460"],"ecosystem":"npm","epss":0.00609,"exploited":false,"fixed_versions":["3.6.5"],"ghsa_id":"GHSA-jgm3-qmp2-c4p7","id":"tcs_01M5KFY1602CQTS56DACNMEDK6","modified_at":"2026-09-25T17:45:04.654368616Z","published_at":"2026-09-17T14:49:56Z","references":["https://osv.dev/vulnerability/GHSA-jgm3-qmp2-c4p7","https://github.com/vendurehq/vendure/security/advisories/GHSA-jgm3-qmp2-c4p7","https://nvd.nist.gov/vuln/detail/CVE-2026-63460","https://github.com/vendurehq/vendure/commit/f74cbbb0b9a50b5b0131822835fe7ee9b71b42c9","https://github.com/vendurehq/vendure","https://github.com/vendurehq/vendure/releases/tag/v3.6.5"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-jgm3-qmp2-c4p7","url":"https://osv.dev/vulnerability/GHSA-jgm3-qmp2-c4p7"}],"summary":"Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends"}