Vulnerability RUSTSEC-2026-0416

The parser of juniper called itself once for each level of nesting in a GraphQL document. The parser had no limit on the nesting depth. Deeply nested selection sets, input values, and list types thus overflowed the stack of the thread that parsed the document. Validation and execution followed fragment spreads in the same recursive way. Long chains of fragment spreads thus overflowed the stack in validation and execution.

A stack overflow aborts the whole process. One request can thus stop a server and drop all other requests in progress. The request needs no authentication.

juniper 0.17.2 rejects documents that nest deeper than 64 levels or contain more than 15,000 tokens. RootNode::limit_depth() and RootNode::limit_tokens() change the limits.