GHSA-hmfr-rx46-4jx2 GraphQL Armor Max-Depth Plugin Bypass via Introspection Query Obfuscation

Not scored Published 26 Aug 2025

Attackers can bypass GraphQL depth limits by naming fragments __schema, allowing resource exhaustion or DoS in applications using graphql-armor.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-hmfr-rx46-4jx2?

GHSA-hmfr-rx46-4jx2 is a vulnerability in @escape.tech/graphql-armor-max-depth, published on 26 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Summary

A query depth restriction using the max-depth property can be bypassed if ignoreIntrospection is enabled (which is the default configuration) by naming your query/fragment __schema.

Details

At the start of the countDepth function, we have the following check for the ignoreIntrospection option:

    if (this.config.ignoreIntrospection &amp;&amp; &#39;name&#39; in node &amp;&amp; node.name?.value === &#39;__schema&#39;) {
        return 0;
    }

However, the node can be one of: FieldNode, FragmentDefinitionNode, InlineFragmentNode, OperationDefinitionNode, FragmentSpreadNode.

For example, consider sending the following query:

query hello {
  books {
    title
  }
}

This would create an OperationDefinitionNode where node.name.value == 'hello'

The proper way to handle this is to check explicitly for the __schema field, which corresponds to a FieldNode.

The fix is

    if (
      this.config.ignoreIntrospection &amp;&amp;
      &#39;name&#39; in node &amp;&amp;
      node.name?.value === &#39;__schema&#39; &amp;&amp;
      node.kind === Kind.FIELD
    ) {
      return 0;
    }

This ensures that the node is explicitly a FieldNode.

PoC

Max depth: 6

query {
  books {
    author {
      books {
        author {
          ...__schema
        }
      }
    }
  }
}
fragment __schema on Author {
  books {
    title
  }
}

Impact

This issue affects applications using the GraphQL Armor Depth Limit plugin with ignoreIntrospection enabled.

Fix

This is fixed in PR#823

Which versions are affected by GHSA-hmfr-rx46-4jx2?

2 open source packages ship an affected version, including @escape.tech/graphql-armor-max-depth.

Package	Affected	Fixed in
`@escape.tech/graphql-armor-max-depth` npm	All versions	`2.4.2`
`@escape.tech/graphql-armor-max-depth` npm	All versions	`2.4.2`

How do I fix GHSA-hmfr-rx46-4jx2?

Upgrade @escape.tech/graphql-armor-max-depth to 2.4.2 or later.

Is GHSA-hmfr-rx46-4jx2 being exploited?

There is no known exploitation of GHSA-hmfr-rx46-4jx2 in the wild and no public exploit code.