CVE-2023-26144
- Sévérité
- Modérée
- CVSS
- 5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P
- CISA KEV
- Absente du catalogue KEV en cache
- EPSS
- Aucun score EPSS en cache
Versions touchées et corrigées
OSV n'indique pas de plage semver pour ce paquet dans l'entrée enregistrée.
Le texte simplifié n'apparaît que s'il est déjà en cache. Cette page ne le génère pas.
Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance. **Note:** It was not p…
Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance. **Note:** It was not proven that this vulnerability can crash the process.
Alias : GHSA-9pv7-vfvm-6vr7
Alerte sur OSV.dev · publiée le 2023-09-20 · modifiée le 2026-10-28
- https://github.com/graphql/graphql-js/releases/tag/v16.8.1
- https://security.snyk.io/vuln/SNYK-JS-GRAPHQL-5905181
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26144.json
- https://nvd.nist.gov/vuln/detail/CVE-2023-26144
- https://github.com/graphql/graphql-js/issues/3955
- https://github.com/graphql/graphql-js/commit/f94b511386c7e47bd0380dcd56553dc063320226