Packagist/webonyx/graphql-php: high 7.5

webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments

Action: Upgrade webonyx/graphql-php to 15.32.2 or later.

composer require webonyx/graphql-php:15.32.2

Affected

Fixed versions

Sources

• osv: GHSA-fc86-6rv6-2jpm
• https://github.com/webonyx/graphql-php/security/advisories/GHSA-fc86-6rv6-2jpm
• https://github.com/graphql/graphql-js/issues/2185
• https://github.com/sangria-graphql-org/sangria/pull/12
• https://github.com/webonyx/graphql-php/commit/996adcfce33442f6fc01214777bc8620cc142d85
• https://github.com/advisories/GHSA-9pv7-vfvm-6vr7
• https://github.com/advisories/GHSA-p4qx-6w5p-4rj2
• https://github.com/webonyx/graphql-php
• https://github.com/webonyx/graphql-php/releases/tag/v15.32.2
• https://spec.graphql.org/October2021/#sec-Field-Selection-Merging

published 2026-05-04T22:22:09Z · modified 2026-05-05T16:12:56.242445Z · JSON