What’s Vulnerable › Products

strawberry-graphql strawberry vulnerabilities

8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your strawberry-graphql strawberry version is affected

Latest strawberry-graphql strawberry vulnerabilities

• CVE-2026-107728 — Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy (CVSS 7.5)
• CVE-2026-107727 — Strawberry legacy graphql-ws retains naturally completed subscription slots (CVSS 3.7)
• CVE-2026-47707 — Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification (CVSS 5.3)
• CVE-2026-47706 — Strawberry GraphQL has a Circular Fragment Reference DOS (CVSS 5.3)
• CVE-2026-45739 — Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs (CVSS 4.3)
• CVE-2026-35523 — Authentication bypass in strawberry-graphql via legacy graphql-ws WebSocket subprotocol (CVSS 7.5)
• CVE-2026-35526 — Strawberry GraphQL affected by a Denial of Service via unbounded WebSocket subscriptions (CVSS 7.5)
• CVE-2025-22151 — Strawberry GraphQL has a type resolution vulnerability (CVSS 3.7)