@apollo/gateway (>=2.3.0-beta.2, <=2.9.4), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by CVE-2025-64172 via @apollo/composition (>=2.3.0-beta.2, <=2.9.4)

@apollo/composition NPM version =2.3.0-beta.2, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: CVE-2025-64172 Source advisory: SNYK:JS-APOLLOCOMPOSITION-14038234...

@apollo/gateway (>=2.10.0-alpha.0, <=2.10.3), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by CVE-2025-64172 via @apollo/composition (>=2.10.0-alpha.0, <=2.10.3)

@apollo/composition NPM version =2.10.0-alpha.0, =2.10.0-alpha.0, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: CVE-2025-64172 Source advisory: SNYK:JS-APOLLOCOMPOSITION-14038234...

@apollo/gateway (>=2.12.0-preview.0, <=2.12.0), @lenne.tech/nest-server (>=11.3.0, <=11.5.0) potentially affected by unknown CVE via @apollo/composition (>=2.12.0-preview.0, <=2.12.0)

@apollo/composition NPM version =2.12.0-preview.0, =2.12.0-preview.0, =11.3.0, =11.5.0 Source cves: unknown CVE Source advisory: OSV:GHSA-M8JR-FXQX-8XX6...

@apollo/gateway (>=2.11.0-preview.1, <=2.11.5-preview.1), @dfanchon/gateway (2.11.0) +1 more potentially affected by unknown CVE via @apollo/composition (>=2.11.0-preview.1, <=2.11.5-preview.1)

@apollo/composition NPM version =2.11.0-preview.1, =2.11.0-preview.1, =11.1.14, =11.2.0 Source cves: unknown CVE Source advisory: OSV:GHSA-M8JR-FXQX-8XX6...

@apollo/gateway (>=2.3.0-beta.2, <=2.9.4), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by unknown CVE via @apollo/composition (>=2.3.0-beta.2, <=2.9.4)

@apollo/composition NPM version =2.3.0-beta.2, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: unknown CVE Source advisory: OSV:GHSA-M8JR-FXQX-8XX6...

@apollo/gateway (>=2.10.0-alpha.3, <=2.10.3), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by unknown CVE via @apollo/composition (>=2.10.0-alpha.3, <=2.10.3)

@apollo/composition NPM version =2.10.0-alpha.3, =2.10.0-alpha.3, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: unknown CVE Source advisory: OSV:GHSA-M8JR-FXQX-8XX6...

@apollo/gateway (>=2.11.0-preview.1, <=2.11.5-preview.1), @dfanchon/gateway (2.11.0) +1 more potentially affected by CVE-2025-64530 via @apollo/composition (>=2.11.0-preview.1, <=2.11.5-preview.1)

@apollo/composition NPM version =2.11.0-preview.1, =2.11.0-preview.1, =11.1.14, =11.2.0 Source cves: CVE-2025-64530 Source advisory: GHSA-MX7M-J9XF-62HW...

@apollo/gateway (>=2.11.0-preview.1, <=2.11.5-preview.1), @dfanchon/gateway (2.11.0) +1 more potentially affected by CVE-2025-64530 via @apollo/composition (>=2.11.0-preview.1, <=2.11.5-preview.1)

@apollo/composition NPM version =2.11.0-preview.1, =2.11.0-preview.1, =11.1.14, =11.2.0 Source cves: CVE-2025-64530 Source advisory: OSV:GHSA-MX7M-J9XF-62HW...

@apollo/gateway (>=2.3.0-beta.2, <=2.9.4), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by CVE-2025-64530 via @apollo/composition (>=2.3.0-beta.2, <=2.9.4)

@apollo/composition NPM version =2.3.0-beta.2, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: CVE-2025-64530 Source advisory: OSV:GHSA-MX7M-J9XF-62HW...

@apollo/gateway (>=2.12.0-preview.1, <=2.12.0), @lenne.tech/nest-server (>=11.3.0, <=11.5.0) potentially affected by CVE-2025-64530 via @apollo/composition (>=2.12.0-preview.1, <=2.12.0)

@apollo/composition NPM version =2.12.0-preview.1, =2.12.0-preview.1, =11.3.0, =11.5.0 Source cves: CVE-2025-64530 Source advisory: GHSA-MX7M-J9XF-62HW...

@apollo/gateway (>=2.12.0-preview.1, <=2.12.0), @lenne.tech/nest-server (>=11.3.0, <=11.5.0) potentially affected by CVE-2025-64530 via @apollo/composition (>=2.12.0-preview.1, <=2.12.0)

@apollo/composition NPM version =2.12.0-preview.1, =2.12.0-preview.1, =11.3.0, =11.5.0 Source cves: CVE-2025-64530 Source advisory: OSV:GHSA-MX7M-J9XF-62HW...

@apollo/gateway (>=2.10.0-alpha.3, <=2.10.3), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by CVE-2025-64530 via @apollo/composition (>=2.10.0-alpha.3, <=2.10.3)

@apollo/composition NPM version =2.10.0-alpha.3, =2.10.0-alpha.3, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: CVE-2025-64530 Source advisory: GHSA-MX7M-J9XF-62HW...

@apollo/gateway (>=2.3.0-beta.2, <=2.9.4), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by CVE-2025-64530 via @apollo/composition (>=2.3.0-beta.2, <=2.9.4)

@apollo/composition NPM version =2.3.0-beta.2, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: CVE-2025-64530 Source advisory: GHSA-MX7M-J9XF-62HW...

@apollo/gateway (>=2.10.0-alpha.3, <=2.10.3), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by CVE-2025-64530 via @apollo/composition (>=2.10.0-alpha.3, <=2.10.3)

@apollo/composition NPM version =2.10.0-alpha.3, =2.10.0-alpha.3, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: CVE-2025-64530 Source advisory: OSV:GHSA-MX7M-J9XF-62HW...

Authentication Bypass Using an Alternate Path or Channel

Overview @apollo/composition is an Apollo Federation composition utilities Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel. An attacker can gain unauthorized access to restricted interface types or fields by crafting queries that target...

@apollo/gateway (>=2.12.0-preview.0, <=2.12.0), @lenne.tech/nest-server (>=11.3.0, <=11.5.0) potentially affected by CVE-2025-64530 via @apollo/composition (>=2.12.0-preview.0, <=2.12.0)

@apollo/composition NPM version =2.12.0-preview.0, =2.12.0-preview.0, =11.3.0, =11.5.0 Source cves: CVE-2025-64530 Source advisory: SNYK:JS-APOLLOCOMPOSITION-13961119...

@apollo/gateway (>=2.3.0-beta.2, <=2.9.4), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by CVE-2025-64530 via @apollo/composition (>=2.3.0-beta.2, <=2.9.4)

@apollo/composition NPM version =2.3.0-beta.2, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: CVE-2025-64530 Source advisory: SNYK:JS-APOLLOCOMPOSITION-13961119...

@apollo/gateway (>=2.11.0-preview.0, <=2.11.5-preview.1), @dfanchon/gateway (2.11.0) +1 more potentially affected by CVE-2025-64530 via @apollo/composition (>=2.11.0-preview.0, <=2.11.5-preview.1)

@apollo/composition NPM version =2.11.0-preview.0, =2.11.0-preview.0, =11.1.14, =11.2.0 Source cves: CVE-2025-64530 Source advisory: SNYK:JS-APOLLOCOMPOSITION-13961119...

@apollo/gateway (>=2.10.0-alpha.0, <=2.10.3), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by CVE-2025-64530 via @apollo/composition (>=2.10.0-alpha.0, <=2.10.3)

@apollo/composition NPM version =2.10.0-alpha.0, =2.10.0-alpha.0, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: CVE-2025-64530 Source advisory: SNYK:JS-APOLLOCOMPOSITION-13961119...

@apollo/gateway (>=2.10.0-alpha.3, <=2.10.3), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by CVE-2025-64530 via @apollo/composition (>=2.10.0-alpha.3, <=2.10.3)

@apollo/composition NPM version =2.10.0-alpha.3, =2.10.0-alpha.3, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: CVE-2025-64530 Source advisory: MEND:CVE-2025-64530...