async-graphql / async-graphql - @DOS GraphQL Nested Fragments overflowGHSA-xq3c-8gqm-v648
HIGHFix: async-graphql/async-graphql@521769bGHSA-xq3c-8gqm-v648 is a high-severity (CVSS 7.5) remote code execution vulnerability in async-graphql. A fix is available for async-graphql — see the affected versions and patch details below.
Real-World Exposure
async-graphqlReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.
Description
Impact
Executing deeply nested queries may cause stack overflow.
Patches
Upgrade to v4.0.6
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🦀crates.io | async-graphql | all versions | 4.0.6cargo update -p async-graphql --precise 4.0.6 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for async-graphql, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update async-graphql to 4.0.6 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-xq3c-8gqm-v648 is resolved across your whole dependency graph.
Workarounds
Constrain what reaches the vulnerable code: limit the size and shape of untrusted input, isolate the affected component in a sandboxed or least-privileged process, and enable the platform's memory-safety mitigations (ASLR, stack protector, hardened allocator) so an out-of-bounds access is more likely to fail closed than to be exploitable.
Frequently Asked Questions
Is GHSA-xq3c-8gqm-v648 in your dependencies?
Find it across crates.io, including transitive dependencies.