The make graphql filter() and make graphql filter sync() filters of juniper warp read the whole body of a POST request into memory before they parsed the body. The filters had no limit on the size of the body. A client could thus send a large body and exhaust the memory of the server. The request needs no authentication.

juniper warp 0.9.1 reads at most 2 MiB of a request body by default. The filters respond with 413 Payload Too Large to larger bodies. make graphql filter with body limit() and make graphql filter sync with body limit() set another limit.