Packages / graphql / Security

ModerateVulnerabilityGHSA-9pv7-vfvm-6vr7CVE-2023-26144Published 20 Sep 2023

graphql Uncontrolled Resource Consumption vulnerability

Affected releases · graphql

  • 16.x16.3.0 – 16.8.0Fixed in 16.8.1

On 16.x, the newest line:

npm install graphql@16.8.1
17.x

  1. Not affected

    17.0.0 – 17.0.2

    3 releases, latest

16.x

  1. Not affected

    16.0.0 – 16.2.0

    4 releases

  2. Affected

    16.3.0 – 16.8.0

    7 releases

  3. Fixed

    16.8.1 – 16.14.2

    12 releases

149 stable releases of graphql, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for graphql. It is read in your browser and sent nowhere.

What happens

Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance.

Note: It was not proven that this vulnerability can crash the process.