Executive brief
AshGraphQL is a GraphQL adapter for the Ash framework used to build data APIs. An unauthenticated attacker can craft a specially-formed GraphQL query with an invalid relay node ID to crash the server with an unhandled exception, potentially exposing sensitive error details and causing a denial of service.
Technical details
The vulnerability is an improper input validation issue in AshGraphQL.Graphql.Resolver.resolve_node/2. The function decodes a base64-encoded relay ID and splits it on a colon character without validating the type segment. The decoded type is passed directly to Map.fetch!, which raises a KeyError if the type does not exist in the type-to-resource map. Because this error occurs before the resolver's resolve/2 clauses and their rescue handlers execute, the exception propagates as an unhandled crash rather than a graceful GraphQL error, potentially exposing stack traces. The fix uses Map.fetch/2 instead, which returns nil on missing keys, allowing the resolver to return a proper "Invalid node id" error. The vulnerability affects ash_graphql versions 0.27.0 through 1.10.x; versions 1.11.0 and later contain the fix. No authentication is required; any unauthenticated client can trigger the crash.
Affected products
- ash-project AshGraphQL 0.27.0 to 1.10.x
Timeline
- 2026-08-30: disclosed