GHSA-9pv7-vfvm-6vr7
- Severity
- Moderate
- CVSS
- 5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- CISA KEV
- Not in the cached KEV catalog
- EPSS
- No cached EPSS score
Affected and fixed versions
- Introduced 16.3.0 · fixed in 16.8.1
The latest published version is not inside an affected range, or OSV lists no fix for it.
Plain-language text is shown only when it is already cached. This page does not generate it.
graphql Uncontrolled Resource Consumption vulnerability
Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance. **Note:** It was not proven that this vulnerability can crash the process.
Aliases: CVE-2023-26144
Advisory on OSV.dev · published 2023-09-20 · modified 2023-11-08
- https://nvd.nist.gov/vuln/detail/CVE-2023-26144
- https://github.com/graphql/graphql-js/issues/3955
- https://github.com/graphql/graphql-js/pull/3972
- https://github.com/graphql/graphql-js/commit/8f4c64eb6a7112a929ffeef00caa67529b3f2fcf
- https://github.com/graphql/graphql-js
- https://github.com/graphql/graphql-js/releases/tag/v16.8.1