Skip to content
OpenAdvisories

Package · Packagist

webonyx/graphql-php

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.2
    CVE-2026-107376

    webonyx graphql-php: Unbounded recursion in parser causes stack overflow on crafted nested input

    webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\Language\Parser performs recursive descent without a recursion limit in parseSelectionSet, parseValueLiteral, and parseTypeReference. A remote attacker can sub…

    webonyx graphql-php webonyx/graphql-php Packagist
  • High 7.5
    GHSA-fc86-6rv6-2jpm

    webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments

    ## Summary `OverlappingFieldsCanBeMerged` validation rule has `O(n^2 x m^2)` worst case via flattened inline fragments. The CVE-2023-26144 named-fragment cache does not cover inline fragments. A 364 KB query (200 outer x 100 inner inline fragments) consumes 1…

    webonyx/graphql-php Packagist