ROOT-APP-NPM-CVE-2025-64530 CVE-2025-64530 in @apollo/composition - Patched by Root

Root has patched CVE-2025-64530 in the @apollo/composition package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-M8JR-FXQX-8XX6 GHSA-m8jr-fxqx-8xx6 in @apollo/composition - Patched by Root

Root has patched GHSA-m8jr-fxqx-8xx6 in the @apollo/composition package for Root:npm. Multiple fixed versions available...

PT-2026-86561

Root has patched GHSA-m8jr-fxqx-8xx6 in the @apollo/composition package for Root:npm. Multiple fixed versions available...

@apollo/composition (>=2.10.0, <=2.10.4), @apollo/gateway (>=2.10.0, <=2.10.4) +6 more potentially affected by CVE-2026-32621 via @apollo/federation-internals (>=2.10.0, <=2.10.4)

@apollo/federation-internals NPM version =2.10.0, =2.10.0, =2.10.0, =2.10.0, =2.10.0, =2.10.0, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

@apollo/composition (>=2.13.0, <=2.13.1), @apollo/gateway (>=2.13.0, <=2.13.1) +4 more potentially affected by CVE-2026-32621 via @apollo/federation-internals (>=2.13.0, <=2.13.1)

@apollo/federation-internals NPM version =2.13.0, =2.13.0, =2.13.0, =2.13.0, =2.13.0, =2.13.0, =0.0.0, =0.0.2-alpha-20260313130016-7fe861602b61cb29c75e6d7e84eae979268037af Source cves: CVE-2026-32621 Source advisory: GHSA-PFJJ-6F4P-RVMH...

@apollo/composition (>=2.11.0-preview.0, <=2.11.5), @apollo/gateway (>=2.11.0-preview.0, <=2.11.5) +5 more potentially affected by CVE-2026-32621 via @apollo/federation-internals (>=2.11.0-preview.0, <=2.11.5)

@apollo/federation-internals NPM version =2.11.0-preview.0, =2.11.0-preview.0, =2.11.0-preview.0, =2.11.0-preview.0, =2.11.0-preview.0, =2.11.0-preview.0, =11.1.14, =11.2.0 Source cves: CVE-2026-32621 Source advisory: SNYK:JS-APOLLOFEDERATIONINTERNALS-15612462...

@apollo/composition (>=2.12.0, <=2.12.2), @apollo/gateway (>=2.12.0, <=2.12.2) +5 more potentially affected by CVE-2026-32621 via @apollo/federation-internals (>=2.12.0, <=2.12.2)

@apollo/federation-internals NPM version =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =11.3.0, =1.0.0, =1.0.13 Source cves: CVE-2026-32621 Source advisory: GHSA-PFJJ-6F4P-RVMH...

@apollo/composition (>=2.12.0-preview.0, <=2.12.2), @apollo/gateway (>=2.12.0-preview.0, <=2.12.2) +5 more potentially affected by CVE-2026-32621 via @apollo/federation-internals (>=2.12.0-preview.0, <=2.12.2)

@apollo/federation-internals NPM version =2.12.0-preview.0, =2.12.0-preview.0, =2.12.0-preview.0, =2.12.0-preview.0, =2.12.0-preview.0, =2.12.0-preview.0, =11.3.0, =1.0.0, =1.0.13 Source cves: CVE-2026-32621 Source advisory: SNYK:JS-APOLLOFEDERATIONINTERNALS-15612462...

@apollo/composition (>=2.11.0, <=2.11.5), @apollo/gateway (>=2.11.0, <=2.11.5) +5 more potentially affected by CVE-2026-32621 via @apollo/federation-internals (>=2.11.0, <=2.11.5)

@apollo/federation-internals NPM version =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =11.1.14, =11.2.0 Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

@apollo/composition (>=2.11.0, <=2.11.5), @apollo/gateway (>=2.11.0, <=2.11.5) +5 more potentially affected by CVE-2026-32621 via @apollo/federation-internals (>=2.11.0, <=2.11.5)

@apollo/federation-internals NPM version =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =11.1.14, =11.2.0 Source cves: CVE-2026-32621 Source advisory: GHSA-PFJJ-6F4P-RVMH...

@apollo/composition (>=2.13.0, <=2.13.1), @apollo/gateway (>=2.13.0, <=2.13.1) +4 more potentially affected by CVE-2026-32621 via @apollo/federation-internals (>=2.13.0, <=2.13.1)

@apollo/federation-internals NPM version =2.13.0, =2.13.0, =2.13.0, =2.13.0, =2.13.0, =2.13.0, =0.0.0, =0.0.2-alpha-20260313130016-7fe861602b61cb29c75e6d7e84eae979268037af Source cves: CVE-2026-32621 Source advisory: MEND:CVE-2026-32621...

@apollo/composition (>=2.12.0, <=2.12.2), @apollo/gateway (>=2.12.0, <=2.12.2) +5 more potentially affected by CVE-2026-32621 via @apollo/federation-internals (>=2.12.0, <=2.12.2)

@apollo/federation-internals NPM version =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =11.3.0, =1.0.0, =1.0.13 Source cves: CVE-2026-32621 Source advisory: MEND:CVE-2026-32621...

@apollo/composition (>=2.11.0, <=2.11.5), @apollo/gateway (>=2.11.0, <=2.11.5) +5 more potentially affected by CVE-2026-32621 via @apollo/federation-internals (>=2.11.0, <=2.11.5)

@apollo/federation-internals NPM version =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =11.1.14, =11.2.0 Source cves: CVE-2026-32621 Source advisory: MEND:CVE-2026-32621...

@apollo/gateway (>=2.12.0-preview.0, <=2.12.0), @lenne.tech/nest-server (>=11.3.0, <=11.5.0) potentially affected by unknown CVE via @apollo/composition (>=2.12.0-preview.0, <=2.12.0)

@apollo/composition NPM version =2.12.0-preview.0, =2.12.0-preview.0, =11.3.0, =11.5.0 Source cves: unknown CVE Source advisory: GHSA-M8JR-FXQX-8XX6...

Incorrect Authorization

Overview @apollo/composition is an Apollo Federation composition utilities Affected versions of this package are vulnerable to Incorrect Authorization via the composition logic, which failed to validate that fields have the same access control requirements as the data they reference. An attacker...

@apollo/gateway (>=2.12.0-preview.0, <=2.12.0), @lenne.tech/nest-server (>=11.3.0, <=11.5.0) potentially affected by CVE-2025-64172 via @apollo/composition (>=2.12.0-preview.0, <=2.12.0)

@apollo/composition NPM version =2.12.0-preview.0, =2.12.0-preview.0, =11.3.0, =11.5.0 Source cves: CVE-2025-64172 Source advisory: SNYK:JS-APOLLOCOMPOSITION-14038234...

@apollo/gateway (>=2.11.0-preview.0, <=2.11.4), @dfanchon/gateway (2.11.0) +1 more potentially affected by CVE-2025-64172 via @apollo/composition (>=2.11.0-preview.0, <=2.11.4)

@apollo/composition NPM version =2.11.0-preview.0, =2.11.0-preview.0, =11.1.14, =11.2.0 Source cves: CVE-2025-64172 Source advisory: SNYK:JS-APOLLOCOMPOSITION-14038234...

@apollo/gateway (>=2.11.0-preview.1, <=2.11.5-preview.1), @dfanchon/gateway (2.11.0) +1 more potentially affected by unknown CVE via @apollo/composition (>=2.11.0-preview.1, <=2.11.5-preview.1)

@apollo/composition NPM version =2.11.0-preview.1, =2.11.0-preview.1, =11.1.14, =11.2.0 Source cves: unknown CVE Source advisory: GHSA-M8JR-FXQX-8XX6...

@apollo/gateway (>=2.10.0-alpha.3, <=2.10.3), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by unknown CVE via @apollo/composition (>=2.10.0-alpha.3, <=2.10.3)

@apollo/composition NPM version =2.10.0-alpha.3, =2.10.0-alpha.3, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: unknown CVE Source advisory: GHSA-M8JR-FXQX-8XX6...

@apollo/gateway (>=2.3.0-beta.2, <=2.9.4), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by unknown CVE via @apollo/composition (>=2.3.0-beta.2, <=2.9.4)

@apollo/composition NPM version =2.3.0-beta.2, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: unknown CVE Source advisory: GHSA-M8JR-FXQX-8XX6...