CVE-2026-40476
1 advisory.
Packagist/webonyx/graphql-php CVE-2026-40476: high 7.5, EPSS 0.73%
graphql-php is affected by a Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation
Action: Upgrade webonyx/graphql-php to 15.31.5 or later.
composer require webonyx/graphql-php:15.31.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 15.31.5 | - |
Fixed versions
| 15.31.5 |
Sources
- osv: GHSA-68jq-c3rv-pcrr
- https://github.com/webonyx/graphql-php/security/advisories/GHSA-68jq-c3rv-pcrr
- https://nvd.nist.gov/vuln/detail/CVE-2026-40476
- https://github.com/webonyx/graphql-php
- https://github.com/webonyx/graphql-php/releases/tag/v15.31.5
CVE-2026-40476 · published · modified · JSON