Junglewise Threat Intelligence

Escape-Technologies GraphQL Armor Max-Depth bypass via fragment caching

Severity: low · CVSS 3 · Published 2025-08-26

Vendors: npm.

Executive brief

GraphQL Armor is a security layer used to protect GraphQL servers from malicious queries. A flaw in its depth-limiting plugin allows attackers to bypass security restrictions by reusing specific query fragments at different nesting levels. This could allow an attacker to send overly complex queries that consume excessive server resources, potentially leading to a denial-of-service (DoS) condition.

Technical details

The vulnerability exists in the `countDepth` function of the `@escape.tech/graphql-armor-max-depth` package. The plugin caches the depth of GraphQL fragments upon their first occurrence in a query to optimize performance. However, it fails to account for the increased total depth when the same fragment is reused later in a more deeply nested part of the query. An attacker can exploit this by crafting a query where a fragment is first used at a shallow depth (to populate the cache) and then reused at a much deeper level, bypassing the configured `max-depth` limit. This is classified as Uncontrolled Resource Consumption (CWE-400) and is fixed in version 2.4.2.

Affected products

  • Escape-Technologies @escape.tech/graphql-armor-max-depth <= 2.4.1

Timeline

  • 2025-08-08: other: Fix submitted via Pull Request
  • 2025-08-18: patched: Fix merged into main branch
  • 2025-08-26: advisory: GitHub Security Advisory published

References

Related threats