GraphQL-core: Denial Of Service Via Quadratic Complexity In The OverlappingFieldsCanBeMerged Validation Rule

Summary The "OverlappingFieldsCanBeMerged" validation rule can be driven into quadratic — and in the worst case "On²·m²" — running time by a small, highly compressible query. A single 364 KB document can occupy one CPU core for over five minutes during validation, before any resolver runs. Becaus...