AIKIDO-2026-289883

TL;DR

The GraphQL WebSocket transport did not apply the parser and validation limits that guard the HTTP GraphQL endpoint, so documents arrived without the query token bound. Because the transport accepts queries and mutations alongside subscriptions, a single message with deeply nested relational fields expands into a disproportionate amount of parsing, validation, and database work. A client that can reach the endpoint can consume CPU, memory, and database connections out of proportion to its request and degrade the API for other users. The fix parses and validates WebSocket documents under the same shared rule set and token limit as the HTTP endpoint.