Skip to content
OpenAdvisories

Package · Packagist

webonyx/graphql-php

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 8.2
    CVE-2026-107376

    webonyx graphql-php: Unbounded recursion in parser causes stack overflow on crafted nested input

    webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\Language\Parser performs recursive descent without a recursion limit in parseSelectionSet, parseValueLiteral, and parseTypeReference. A remote attacker can sub…

    webonyx graphql-php webonyx/graphql-php Packagist
  • High 7.5
    GHSA-fc86-6rv6-2jpm

    webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments

    ## Summary `OverlappingFieldsCanBeMerged` validation rule has `O(n^2 x m^2)` worst case via flattened inline fragments. The CVE-2023-26144 named-fragment cache does not cover inline fragments. A 364 KB query (200 outer x 100 inner inline fragments) consumes 1…

    webonyx/graphql-php Packagist
  • Medium 6.9
    CVE-2026-40476

    graphql-php: Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation

    graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation rule performs O(n²) pairwise comparisons of fields sharing the same response name. An attacker can send a query with thousands of repeated…

    webonyx graphql-php webonyx/graphql-php Packagist