Log in Start free

Vulnerability · Published Sep 20, 2023 · Assigned by snyk

CVE-2023-26144

Medium 5.3

In plain English

A medium-severity uncontrolled resource consumption in graphql. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)1.5%top 26.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance. **Note:** It was not proven that this vulnerability can crash the process.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-graphqlno fix listedDEBIAN-CVE-2023-26144
Debian:13node-graphql16.8.1-1DEBIAN-CVE-2023-26144
Debian:14node-graphql16.8.1-1DEBIAN-CVE-2023-26144
Ubuntu:22.04:LTSnode-graphqlno fix listedUBUNTU-CVE-2023-26144
Ubuntu:24.04:LTSnode-graphqlno fix listedUBUNTU-CVE-2023-26144
Ubuntu:25.10node-graphqlno fix listedUBUNTU-CVE-2023-26144
Ubuntu:26.04:LTSnode-graphqlno fix listedUBUNTU-CVE-2023-26144
Ubuntu:26.10node-graphqlno fix listedUBUNTU-CVE-2023-26144
npmgraphql16.8.1GHSA-9pv7-vfvm-6vr7

Affected products (as reported)

VendorProductVersions
n/a graphql 16.3.0 – before 16.8.1

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P

References