webonyx/graphql-php

Security advisories for webonyx/graphql-php, newest first. 3 known, 2 without a fix yet.

RSS feed Check your lock file →

Latest version

15.39.0

Advisories

3 · 2 unfixed

Last advisory

5 May 2026

Safe from

no fix for all yet

3 advisories · newest first

HIGH8.2 5 May 2026

webonyx/graphql-php has unbounded recursion in parser that causes stack overflow on crafted nested input

GHSA-r7cg-qjjm-xhqq

Affected

≤ 15.32.2

Fixed in

no fix yet

Published

5 May 2026

HIGH7.5 4 May 2026

webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments

GHSA-fc86-6rv6-2jpm

Affected

< 15.32.2

Fixed in

15.32.2

Published

4 May 2026

MODERATE7.5 14 Apr 2026

graphql-php is affected by a Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation

GHSA-68jq-c3rv-pcrr · CVE-2026-40476

Affected

≤ 15.31.4

Fixed in

no fix yet

Published

14 Apr 2026

/advisories/composer/webonyx/graphql-php/feed.rss

From Packagist and the GitHub advisory database · synced hourly

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →