Executive brief
GraphQL Armor is a security plugin that enforces query depth limits to prevent expensive or malicious queries from consuming excessive server resources. An attacker can bypass the max-depth protection by naming a query or fragment "__schema" instead of a field, allowing deep nested queries to execute when introspection blocking is enabled. This could lead to denial of service through resource exhaustion.
Technical details
The vulnerability is a logic error in the countDepth function of the max-depth plugin. The code checks if a node's name is "__schema" to skip depth counting when ignoreIntrospection is enabled, but fails to verify that the node is specifically a FieldNode. Attackers can exploit this by naming an OperationDefinitionNode, FragmentDefinitionNode, or FragmentSpreadNode "__schema", causing the function to return 0 and bypass depth restrictions. The fix adds an explicit Kind.FIELD check to ensure only actual __schema field nodes are ignored. The vulnerability affects versions up to 2.4.1 and is fixed in 2.4.2 via PR#823.
Affected products
- Escape Technologies GraphQL Armor Max-Depth Plugin <=2.4.1
Timeline
- 2025-08-26: disclosed
- 2025-08-18: patched: Fix merged in PR#823