strawberry-graphql
python · strawberry-graphqlHeads-up
strawberry-graphql QueryDepthLimiter DoS via circular fragment spreads
The QueryDepthLimiter extension lacks cycle detection in fragment spreads.
09 Jun 2026 · schedule it
python · strawberry-graphqlHeads-up
strawberry-graphql MaxAliasesLimiter bypass via FragmentSpreadNode
The MaxAliasesLimiter extension does not count aliases expanded from FragmentSpreadNode, letting attackers bypass alias limits and
09 Jun 2026 · schedule it