MediumGHSA-9pv7-vfvm-6vr7CVE-2023-26144
graphql Uncontrolled Resource Consumption vulnerability
Published 20 Sept 2023 · Updated 8 Nov 2023
Affected package
graphqlnpm
- Affected
- >=16.3.0 <16.8.1
- Fixed in
- 16.8.1
Update to the fixed version for your release line, for example:
npm install graphql@16.8.1Details
Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance.
Note: It was not proven that this vulnerability can crash the process.
Is GHSA-9pv7-vfvm-6vr7 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected graphql, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2023-26144
- Linkgithub.com/graphql/graphql-js/issues/3955
- Linkgithub.com/graphql/graphql-js/pull/3972
- Linkgithub.com/graphql/graphql-js/commit/8f4c64eb6a7112a929ffeef00caa67529b3f2fcf
- Packagegithub.com/graphql/graphql-js
- Linkgithub.com/graphql/graphql-js/releases/tag/v16.8.1
- Linksecurity.snyk.io/vuln/SNYK-JS-GRAPHQL-5905181
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.