Executive brief
Strawberry GraphQL is a library used by developers to build GraphQL APIs. A flaw in its security filtering allows attackers to bypass limits on how many data aliases can be requested in a single query. By using a specific technique called fragment expansion, an attacker can force the server to process significantly more data than intended, potentially causing the service to slow down or crash due to resource exhaustion.
Technical details
The MaxAliasesLimiter extension in Strawberry GraphQL (versions 0.172.0 through 0.315.6) incorrectly calculates the number of aliases in a GraphQL request. While it counts static aliases within the Abstract Syntax Tree (AST), it fails to account for the amplification effect of FragmentSpreadNode. An attacker can define a fragment containing multiple aliases and reference that fragment numerous times; the limiter only counts the fragment definition once rather than multiplying it by the number of times it is spread. This allows a remote, unauthenticated attacker to trigger excessive CPU and memory consumption by forcing the server to resolve and render a much higher number of aliases than the configured limit. The issue is fixed in version 0.315.7 by ensuring fragment spreads are expanded during the alias counting process.
Affected products
- Strawberry GraphQL strawberry-graphql >= 0.172.0, <= 0.315.6
Timeline
- 2026-05-19: patched: Version 0.315.7 released
- 2026-05-19: advisory: GitHub Security Advisory GHSA-fr49-mhgj-crfc published
- 2026-06-04: disclosed: CVE-2026-47707 published to NVD