GraphQL allows nested selections, which means a malicious or careless client can construct deeply nested operations. Deep queries can consume large amounts of CPU, memory, and database resources.

A query-depth limit restricts how deeply fields may be nested. The exact limit should be chosen based on the application's schema and legitimate use cases rather than using an arbitrary value without measurement.