webonyx/graphql-php
Packagist2 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting webonyx/graphql-phppage 1 of 1
- CVE-2026-107376HIGHCVSS 8.2EG 8.2fixed in 15.32.32026-10-08
vulnerable: 14.10.0 ... v15.9.1 (190 versions)
webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\Language\Parser performs recursive descent without a recursion limit in parseSelectionSet, parseValueLiteral, and parseTypeReference. A rem…
- CVE-2026-40476HIGHCVSS 7.5EG 7.5fixed in 15.31.52026-04-17
vulnerable: 14.10.0 ... v15.9.1 (186 versions)
graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation rule performs O(n²) pairwise comparisons of fields sharing the same response name. An attacker can send a query with …
Check whether webonyx/graphql-php is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for webonyx/graphql-php CVEs against the assets you own.
Book a Demo →