CVE-2026-75507

Name of the Vulnerable Software and Affected Versions GraphQL-core versions 3.0.0 through 3.2.11 GraphQL-core versions 3.3.0rc0 and earlier

Description An unauthenticated remote attacker can cause a denial of service by submitting a shallow, highly compressible GraphQL query. The issue exists in the OverlappingFieldsCanBeMerged validation rule within specified rules, which repeatedly compares fields sharing response names and recursively re-compares flattened inline fragments. Because memoization does not cover this path, nested repeated inline fragments can lead to quadratic or worst-case O(n²·m²) CPU consumption during the validation phase. This occurs before any resolver or AST-based depth and complexity controls are executed, allowing a small request to pin a worker process and saturate multi-worker services.

Recommendations Update GraphQL-core to version 3.2.12 or 3.3.0rc1. As a temporary mitigation, reject oversized documents before they reach the validate() function, ensuring the body-size limit is applied to the decompressed request body.