GraphQL Depth Bomb DoS
GraphQL APIs without depth limits are vulnerable to denial-of-service attacks via deeply nested queries. A single malicious query can exhaust server resources, causing outages for all users.
Overview
GraphQL's nested query structure allows clients to request deeply nested data in a single request. Without protection, attackers can craft queries that nest hundreds of levels deep, causing exponential backend work and server crashes.
Types & Variants
Circular Reference Attack
Exploiting circular relationships (user->posts->author->posts) to create infinite depth.
Alias Multiplication
Using aliases to multiply expensive operations at each nesting level.
Impact
Service denial, server resource exhaustion, increased infrastructure costs, cascading failures.
Examples
Depth Bomb Query
{
user {
posts {
author {
posts {
author {
# ... 50+ levels deep
}
}
}
}
}
}Remediation
Implement query depth limiting (max 10-15 levels). Add query complexity analysis with cost limits. Use persisted queries and query allowlisting in production.
Set maximum query depth (10-15 levels is reasonable)
Implement query complexity scoring
Add request timeouts
Use caching and rate limiting
Related SuperClue scanner checks
These scanner checks look for signs of GraphQL Depth Bomb DoS. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works