CVE-2026-1174: 
NixOS vulnerability analysis and mitigation

CVE-2026-1174 is a GraphQL Alias Overloading (resource exhaustion) vulnerability in birkir/prime, an open-source self-hosted headless CMS with a GraphQL interface. It affects all versions of birkir prime up to and including 0.4.0.beta.0, specifically the /graphql endpoint's GraphQL Alias Handler component. The vulnerability was reported via a GitHub issue on January 3, 2026, and the CVE was published on January 19, 2026; the project maintainer had not responded as of disclosure. CVSS v3.1 base score is 7.5 (High) per NVD, while the CNA (VulDB) rates it 5.3 (Medium) (GitHub Issue, Red Hat CVE).

The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-404 (Improper Resource Shutdown or Release). The GraphQL Alias Handler in the /graphql endpoint does not impose limits on the number of aliases that can be used within a single query, allowing an attacker to craft a single POST request containing hundreds of aliased field resolutions (e.g., alias0:__typename, alias1:__typename, ..., alias100:__typename) that force the server to process each alias independently, exhausting CPU and memory resources. No authentication is required, and exploitation requires only network access to the /graphql endpoint. A public proof-of-concept exploit demonstrating the technique was included in the original GitHub issue report (GitHub Issue, Red Hat CVE).

Successful exploitation causes denial of service (DoS) by exhausting server-side resources, rendering the Prime CMS instance unavailable to legitimate users. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Because the attack requires no authentication and can be executed remotely with a single crafted HTTP request, even low-skilled attackers can repeatedly trigger service disruption (GitHub Issue, Red Hat CVE).

A public proof-of-concept exploit is available in the GitHub issue report, consisting of a curl command that sends a crafted GraphQL query with over 100 aliased __typename fields in a single request. As of the time of disclosure, there is no evidence of active in-the-wild exploitation, and no threat actor attribution has been reported. The EPSS score is approximately 0.039% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Issue, Red Hat CVE).

1. Reconnaissance: Identify internet-facing instances of birkir/prime CMS (versions ≤ 0.4.0.beta.0) by searching for exposed /graphql endpoints using tools like Shodan or Censys, or by fingerprinting the Prime CMS interface.
2. Craft malicious GraphQL query: Construct a GraphQL query that uses a large number of aliases for the same field (e.g., alias0:__typename, alias1:__typename, ..., alias100:__typename) within a single query body.
3. Send the overloaded request: Submit the crafted query as an HTTP POST request to the /graphql endpoint with Content-Type: application/json:

curl -X POST -H "Content-Type: application/json" \
  -d '{"query": "query cop { alias0:__typename \nalias1:__typename \n...alias100:__typename \n}", "operationName": "cop"}' \
  'http://<target>/graphql'

4. Repeat to sustain DoS: Send the request repeatedly or in parallel to continuously exhaust server CPU/memory resources, preventing legitimate users from accessing the CMS (GitHub Issue).

• Network: High volume of HTTP POST requests to /graphql from a single or small set of source IPs; requests with unusually large Content-Length headers targeting the GraphQL endpoint.
• Logs: Web server or application logs showing repeated POST requests to /graphql with query bodies containing large numbers of aliased fields (e.g., alias0:__typename, alias1:__typename, etc.); elevated response times or timeouts on the /graphql endpoint.
• Process/System: Sudden spikes in CPU or memory utilization on the Prime CMS server process; increased garbage collection activity in the Node.js runtime hosting Prime.
• Application: Service degradation or unresponsiveness of the Prime CMS admin interface or GraphQL API coinciding with the above network patterns (GitHub Issue).

Upgrade birkir/prime to a version above 0.4.0.beta.0 as the primary remediation; a patch was documented in the project repository as of February 4, 2026. As an interim workaround, restrict network-level access to the /graphql endpoint using a firewall or reverse proxy to trusted IP ranges only. Additionally, deploying a GraphQL-aware WAF or API gateway that enforces query complexity and alias limits can mitigate the attack surface until patching is complete (GitHub Issue, Red Hat CVE).

The vulnerability received limited but notable coverage across automated vulnerability tracking platforms including Vulners, CIRCL, and Radar by Offseq shortly after publication. A brief post appeared on Bluesky via the CVE Skyfleet feed, and a technical write-up was published by Infinitsec. Red Hat acknowledged the CVE in their security advisory database. The project maintainer had not publicly responded to the issue report as of the time of disclosure (Red Hat CVE, GitHub Issue).