CVE-2023-26144

Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance. **Note:** It was not proven that this vulnerability can crash the process.

• CWE-400
• CWE-400

• https://github.com/graphql/graphql-js/commit/f94b511386c7e47bd0380dcd56553dc063320226Patch
• https://github.com/graphql/graphql-js/issues/3955Exploit, Issue Tracking, Third Party Advisory
• https://github.com/graphql/graphql-js/pull/3972Product
• https://github.com/graphql/graphql-js/releases/tag/v16.8.1Release Notes
• https://security.snyk.io/vuln/SNYK-JS-GRAPHQL-5905181Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/graphql/graphql-js/commit/f94b511386c7e47bd0380dcd56553dc063320226Patch
• https://github.com/graphql/graphql-js/issues/3955Exploit, Issue Tracking, Third Party Advisory
• https://github.com/graphql/graphql-js/pull/3972Product
• https://github.com/graphql/graphql-js/releases/tag/v16.8.1Release Notes
• https://security.snyk.io/vuln/SNYK-JS-GRAPHQL-5905181Exploit, Issue Tracking, Patch, Third Party Advisory

Published

Sep 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26139Versions of the package underscore-keypath from 0.0.11 are v…7.5
• CVE-2023-2614Cross-site Scripting (XSS) - DOM in GitHub repository pimcor…5.4
• CVE-2023-26140Versions of the package @excalidraw/excalidraw from 0.0.0 ar…6.1
• CVE-2023-26141Versions of the package sidekiq before 7.1.3 are vulnerable …4.9
• CVE-2023-26142All versions of the package crow are vulnerable to HTTP Resp…6.1
• CVE-2023-26143Versions of the package blamer before 1.0.4 are vulnerable t…9.1
• CVE-2023-26145This affects versions of the package pydash before 6.0.0. A …8.1
• CVE-2023-26146All versions of the package ithewei/libhv are vulnerable to …6.1
• CVE-2023-26147All versions of the package ithewei/libhv are vulnerable to …6.1
• CVE-2023-26148All versions of the package ithewei/libhv are vulnerable to …5.3
• CVE-2023-26149Versions of the package quill-mention before 4.0.0 are vulne…6.1
• CVE-2023-2615Cross-site Scripting (XSS) - Reflected in GitHub repository …5.4