The webonyx/graphql-php library has a performance vulnerability in its OverlappingFieldsCanBeMerged validation rule. The rule exhibits quadratic to quartic complexity (O(n^2 x m^2)) when processing nested inline fragments, causing excessive CPU consumption for large queries with many inline fragments. This is due to the lack of caching for inline fragments, which are unnamed and thus not covered by the existing named-fragment cache. The issue affects version 15.31.4 and earlier and is fixed in version 15.32.2.