{"action":"Upgrade webonyx/graphql-php to 15.32.2 or later.","affected":[{"fixed":"15.32.2","introduced":"0"}],"component":"webonyx/graphql-php","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":["15.32.2"],"ghsa_id":"GHSA-fc86-6rv6-2jpm","id":"tcs_01M5KF1PJ8V7J92FDTW2P3FKEN","modified_at":"2026-05-05T16:12:56.242445Z","published_at":"2026-05-04T22:22:09Z","references":["https://osv.dev/vulnerability/GHSA-fc86-6rv6-2jpm","https://github.com/webonyx/graphql-php/security/advisories/GHSA-fc86-6rv6-2jpm","https://github.com/graphql/graphql-js/issues/2185","https://github.com/sangria-graphql-org/sangria/pull/12","https://github.com/webonyx/graphql-php/commit/996adcfce33442f6fc01214777bc8620cc142d85","https://github.com/advisories/GHSA-9pv7-vfvm-6vr7","https://github.com/advisories/GHSA-p4qx-6w5p-4rj2","https://github.com/webonyx/graphql-php","https://github.com/webonyx/graphql-php/releases/tag/v15.32.2","https://spec.graphql.org/October2021/#sec-Field-Selection-Merging"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-fc86-6rv6-2jpm","url":"https://osv.dev/vulnerability/GHSA-fc86-6rv6-2jpm"}],"summary":"webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments"}