Packagist/webonyx/graphql-php CVE-2026-107376: high 8.2, EPSS 0.45%
webonyx/graphql-php has unbounded recursion in parser that causes stack overflow on crafted nested input
Action: Upgrade webonyx/graphql-php to 15.32.3 or later.
composer require webonyx/graphql-php:15.32.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 15.32.3 | - |
Fixed versions
| 15.32.3 |
Sources
- osv: GHSA-r7cg-qjjm-xhqq
- https://github.com/webonyx/graphql-php/security/advisories/GHSA-r7cg-qjjm-xhqq
- https://github.com/webonyx/graphql-php/commit/7b7f2080ca5f7d5340a696fc5701b19a9222d2c2
- https://github.com/webonyx/graphql-php
- https://github.com/webonyx/graphql-php/releases/tag/v15.32.3
CVE-2026-107376 · published · modified · JSON