AIKIDO-2026-355163
ash_graphql is vulnerable to Denial of Service
49
Medium Risk
This Affects:
ash_graphqlTL;DR
The AshGraphql.Graphql.Resolver.resolve_node/2 function decodes a client-supplied relay global ID and looks up its type segment with Map.fetch!/2 without validating it. An unmapped type segment raises a KeyError before error handling runs, crashing the node(id: ...) query with a 500 response and potentially exposing stacktrace details. The type segment must correspond to an existing atom, but common resource names are guessable. The fix returns a GraphQL error for unknown relay node types instead of raising.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you expose Relay node queries.
Background info
ash_graphql is vulnerable to Denial of Service in versions 0.27.0 - 1.10.1.
How to fix this
Upgrade the ash_graphql library to the patch version.
Links
Other
github.com/ash-project/ash_graphql/blob/v1.11.0/CHANGELOG.md#v1110-2026-08-30
cna.erlef.org/cves/CVE-2026-81633.htmlosv.dev/vulnerability/EEF-CVE-2026-81633
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.