Vulnerabilities for strawberry-graphql

First version without a known vulnerability: 0.315.7

Details

• GHSA-fr49-mhgj-crfc2026-06-04

  Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification

  Fixed in: 0.315.7

• GHSA-qfwv-87qj-98xq2026-06-04

  Strawberry GraphQL has a Circular Fragment Reference DOS

  Fixed in: 0.315.7

• GHSA-x97m-qp5c-w9xj2026-05-19

  Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs

  Fixed in: 0.315.4

• GHSA-hv3w-m4g2-5x772026-04-06

  strawberry-graphql: Denial of Service via unbounded WebSocket subscriptions

  Fixed in: 0.312.3

• GHSA-vpwc-v33q-mq892026-04-06

  strawberry-graphql: Authentication bypass via legacy graphql-ws WebSocket subprotocol

  Fixed in: 0.312.3

• GHSA-5xh2-23cc-5jc62025-01-09

  Strawberry GraphQL has type resolution vulnerability in node interface that allows potential data leakage through incorrect type resolution

  Fixed in: 0.257.0

• GHSA-79gp-q4wv-33fr2024-09-25

  Cross-Site Request Forgery (CSRF) in strawberry-graphql

  Fixed in: 0.243.0, 37265b230e511480a9ceace492f9f6a484be1387