CVE-2026-81633

Name of the Vulnerable Software and Affected Versions ash graphql versions 0.27.0 through 1.10.9

Description Improper input validation allows an unauthenticated client to crash a relay node(id: ...) query. The AshGraphql.Graphql.Resolver.resolve node/2 function uses decode relay id/1 to decode a client-supplied global ID, which base64-decodes the string and splits it without validating the type segment. This decoded type is then passed to Map.fetch!(type to domain and resource map, type). Since fetch! raises an error on a missing key, a relay ID with a type segment that is a valid atom but not a relay-exposed type causes the resolver to abort before rescue handlers can execute. This results in an unhandled KeyError that may expose a stacktrace instead of returning a standard GraphQL error.

Recommendations Update ash graphql to version 1.11.0 or later.