# RUSTSEC-2026-0416 - Stack overflow on deeply nested GraphQL documents

Source: https://junglewise.ai/threats/rustsec-2026-0416-stack-overflow-on-deeply-nested-graphql-documents-989697e9  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2026-10-28

Stack overflow on deeply nested GraphQL documents

Technologies: [juniper (crates.io)](https://junglewise.ai/threats/technologies/juniper). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 28 October 2026.

**Which products and versions are affected?** juniper (crates.io) SEMVER:introduced=0.0.0-0,fixed=0.17.2.

**Is there a fix for This vulnerability?** Yes. juniper (crates.io): upgrade to 0.17.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected?** Check whether you run juniper (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- juniper (crates.io): upgrade to 0.17.2 or later

  ```sh
  cargo update -p juniper
  ```


## Affected products

- juniper (crates.io) SEMVER:introduced=0.0.0-0,fixed=0.17.2

## Identifiers

- GHSA-34cw-x8g7-rcv5
- RUSTSEC-2026-0416

## Related threats

- [RUSTSEC-2026-0417 - Excessive CPU and memory use on crafted GraphQL documents](https://junglewise.ai/threats/rustsec-2026-0417-excessive-cpu-and-memory-use-on-crafted-graphql-24030cea)
- [RUSTSEC-2022-0038 - Denial of service on deeply nested fragment requests](https://junglewise.ai/threats/cve-2022-31173-juniper-is-vulnerable-to-dos-graphql-nested-fragments-overflow)