Search results

graph-node uses blake3 versions that install a potentially compromised arrayref dependency

Status: Open.

#6714 In graphprotocol/graph-node;

· dimitrovmaksim opened on Aug 21, 2026

[Security Review] GraphQL Query Security & Data Integrity Analysis

Status: Open.

#6711 In graphprotocol/graph-node;

· group3vigil opened on Aug 12, 2026

Entity LFU cache eviction is process-dependent: store read counts are not reproducible across otherwise identical runs

Status: Open.

#6706 In graphprotocol/graph-node;

· madumas opened on Aug 10, 2026

[QmZsgJLiLQKpb8hxTmQ5LWyrFVvfWzVaL4WK8dfFBn7EeK] handleInitialize drops the Pool when a currency's decimals() reverts

Status: Open.

#6705 In graphprotocol/graph-node;

· 0x19dG87 opened on Aug 10, 2026

entityChangesInBlock fails with "UNION types bytea and text cannot be matched" on schemas mixing Bytes and String IDs

Status: Open.

#6695 In graphprotocol/graph-node;

· madumas opened on Jul 23, 2026

[Feature] Allow querying the Proof of Indexing of a non-active deployment copy

enhancementNew feature or requestNew feature or request

Status: Open.

#6694 In graphprotocol/graph-node;

· madumas opened on Jul 23, 2026

Firehose block stream can hang indefinitely with no idle/read timeout → subgraph silently stops indexing until restart

Status: Open.

#6689 In graphprotocol/graph-node;

· madumas opened on Jul 20, 2026

Docker image includes Debian perl-base packages with unresolved CVEs

Status: Open.

#6686 In graphprotocol/graph-node;

· AndrewDucDanhDo opened on Jul 16, 2026

gnd: scaffolding follow-ups from #6660 review

Status: Open.

#6684 In graphprotocol/graph-node;

· incrypto32 opened on Jul 15, 2026

ethereum.decode() strictness change in 0.42.0 can cause silent data loss and network-wide POI divergence (subgraph stays healthy) — CCTP subgraphs affected

Status: Open.

#6683 In graphprotocol/graph-node;

· madumas opened on Jul 14, 2026

RUSTSEC-2026-0195: Unbounded namespace-declaration allocation in NsReader enables memory-exhaustion denial of service

Status: Open.

#6674 In graphprotocol/graph-node;

· github-actions opened on Jul 8, 2026

RUSTSEC-2026-0194: Quadratic run time when checking a start tag for duplicate attribute names

Status: Open.

#6673 In graphprotocol/graph-node;

· github-actions opened on Jul 8, 2026