AIKIDO-2026-861520
graphql-core is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
graphql-coreTL;DR
GraphQL-Core parses GraphQL documents under a max_tokens limit meant to cap the memory the parser allocates. Comment tokens were never counted against that limit, so a document padded with comments bypasses the cap. Externally supplied queries can therefore allocate memory far larger than the token limit implies and exhaust process memory without authentication. The fix counts skipped comment tokens, including trailing comments, toward max_tokens.
Who does this affect?
You are affected if you run a version that falls within the vulnerable range and your application parses GraphQL documents from untrusted or externally supplied input.
Background info
graphql-core is vulnerable to Denial of Service (DoS) in versions 3.2.3 - 3.2.11.
How to fix this
Upgrade the graphql-core library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.