Executive brief
GraphQL is a query language library used by web applications and APIs to process data requests from clients. This vulnerability allows an attacker to send specially crafted queries that consume excessive CPU resources, degrading performance and potentially causing service disruptions for legitimate users. An attacker can exploit this without authentication by submitting large, overlapping field queries.
Technical details
This is an uncontrolled resource consumption (CWE-400) vulnerability in the graphql-js library's OverlappingFieldsCanBeMergedRule validation logic. Versions 16.3.0 through 16.8.0 lack sufficient input validation when parsing complex queries with many repeated or overlapping fields, allowing attackers to trigger quadratic or exponential algorithmic complexity. The vulnerability is reachable over the network without authentication or user interaction. An attacker can craft queries containing thousands of repeated field selections (e.g., `__typename`) to exhaust server CPU, increase response latency, and degrade availability. The vulnerability was fixed in version 16.8.1.
Affected products
- GraphQL graphql-js 16.3.0 to 16.8.0
Timeline
- 2023-09-20: disclosed: Public disclosure via GitHub Advisory
- 2023-09-20: patched: Fixed in version 16.8.1
- 2023-08-18: other: Vulnerability initially reported via GitHub issue #3955