CVE-2026-1174
📋 TL;DR
This vulnerability in birkir prime's GraphQL Alias Handler allows remote attackers to cause resource consumption (denial of service) through manipulation of the /graphql endpoint. It affects all users running birkir prime up to version 0.4.0.beta.0. The vulnerability is remotely exploitable and has been publicly disclosed.
💻 Affected Systems
- birkir prime
📦 What is this software?
Prime by Birkir
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to resource exhaustion, potentially affecting all users of the application.
Likely Case
Degraded performance or temporary service disruption for affected endpoints.
If Mitigated
Minimal impact with proper rate limiting and resource monitoring in place.
🎯 Exploit Status
Exploit details are publicly available in the GitHub issue; remote exploitation requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Monitor the GitHub repository for updates: https://github.com/birkir/prime/issues/545
🔧 Temporary Workarounds
Implement GraphQL Query Depth Limiting
allLimit the maximum depth of GraphQL queries to prevent resource exhaustion attacks.
# Implementation depends on your GraphQL server setup. For Apollo Server: depthLimit(10)
Implement Rate Limiting
allAdd rate limiting to the /graphql endpoint to prevent abuse.
# Use middleware like express-rate-limit for Node.js applications
🧯 If You Can't Patch
- Block or restrict access to the /graphql endpoint using network controls or WAF rules.
- Monitor server resource usage (CPU, memory) and set up alerts for abnormal consumption patterns.
🔍 How to Verify
Check if Vulnerable:
Check if running birkir prime version 0.4.0.beta.0 or earlier with GraphQL endpoint enabled.Check Version:
Check package.json or application configuration for birkir prime version.Verify Fix Applied:
Verify version is later than 0.4.0.beta.0 once patch is available.📡 Detection & Monitoring
Log Indicators:
- Unusually large or complex GraphQL queries
- Spike in CPU/memory usage from GraphQL processes
- Multiple rapid requests to /graphql endpoint
Network Indicators:
- High volume of POST requests to /graphql
- Large payloads sent to GraphQL endpoint
SIEM Query:
source="application_logs" AND (uri_path="/graphql" AND (request_size>10000 OR request_count>100 per minute))