george0papasotiriou/cve-2026-11103-graphql-batching-alias-rate-limit-bypassProof-of-concept exploit for CVE-2026-11103 demonstrating GraphQL rate-limit bypass through batching and field aliases; includes vulnerable Node.js server and Python exploit script.
// graphql_rate_limit_server.js - GraphQL with naive rate limiter
const express = require('express');
const { graphqlHTTP } = require('express-graphql');
const { buildSchema } = require('graphql');
const schema = buildSchema(`
type Query {
secret: String
}
`);
let requestCount = 0;
const rateLimit = (req, res, next) => {
requestCount++;
if (requestCount > 5) {
return res.status(429).send('Rate limit exceeded');
}
next();
};
const root = { secret: () => 'SuperSecretData' };
const app = express();
app.use(rateLimit);
app.use('/graphql', graphqlHTTP({ schema, rootValue: root, graphiql: true }));
app.listen(4000, () => console.log('GraphQL on :4000'));
A GraphQL API enforces rate limiting based on the number of HTTP requests, not on the complexity or number of resolved fields. By using field aliases, an attacker can issue multiple expensive queries within a single HTTP request, effectively bypassing the rate limit.
npm install express express-graphql graphql
node graphql_rate_limit_server.js
python exploit_graphql_alias_bypass.py