{"items":[{"id":"NVI-00006909","kind":"vulnerability","title":"webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-fc86-6rv6-2jpm"],"plain_summary":"OSV carries this publisher advisory for webonyx/graphql-php. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 15.32.2 for webonyx/graphql-php. Confirm the publisher’s latest guidance.","source_ids":["sr-c6f1fb952e3eae6ecacf1b6b2bd13037"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-c6f1fb952e3eae6ecacf1b6b2bd13037","url":"https://github.com/advisories/GHSA-fc86-6rv6-2jpm","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-fc86-6rv6-2jpm","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:10.713Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-c6f1fb952e3eae6ecacf1b6b2bd13037"],"technology":"webonyx/graphql-php","known_exclusions":[],"conditions_summary":"## Summary\n\n`OverlappingFieldsCanBeMerged` validation rule has `O(n^2 x m^2)` worst case via flattened inline fragments. The CVE-2023-26144 named-fragment cache does not cover inline fragments. A 364 KB query (200 outer x 100 inner inline fragments) consumes 117 seconds of CPU per request, with no comparison budget and no validation timeout.\n\n## Affected Component\n\n`src/Validator/Rules/OverlappingFieldsCanBeMerged.php`\n\n## Description\n\ngraphql-php is a PHP port of graphql-js and inherits the same `OverlappingFieldsCanBeMerged` algorithm. The rule performs an explicit `O(n^2)` pairwise comparison loop over fields collected for each response name (`collectConflictsWithin`), and recurses into sub-selections via `findConflict`. When the rule receives a query in which several inline fragments select the same response name at multiple nesting levels, the cost compounds to `O(n^2 x m^2)` where `n` and `m` are the number of inline fragments at the outer and inner levels respectively.\n\ngraphql-php includes a `comparedFragmentPairs` PairSet cache (the same class of memoization fix tracked under CVE-2023-26144 / GHSA-9pv7-vfvm-6vr7), but it","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 15.32.2"]}],"null_published_at":"2026-10-31T22:13:14.303Z","source_updated_at":"2026-05-05T16:12:56.242Z","source_disclosed_at":"2026-05-04T22:22:09.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:42:10.713Z"}],"next_cursor":null,"snapshot_revision":"42594"}