@apollo/gateway (>=2.11.0-preview.1, <=2.11.5-preview.1), @dfanchon/gateway (2.11.0) +1 more potentially affected by CVE-2025-64530 via @apollo/composition (>=2.11.0-preview.1, <=2.11.5-preview.1)

@apollo/composition NPM version =2.11.0-preview.1, =2.11.0-preview.1, =11.1.14, =11.2.0 Source cves: CVE-2025-64530 Source advisory: MEND:CVE-2025-64530...

@apollo/gateway (>=2.3.0-beta.2, <=2.9.4), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by CVE-2025-64530 via @apollo/composition (>=2.3.0-beta.2, <=2.9.4)

@apollo/composition NPM version =2.3.0-beta.2, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: CVE-2025-64530 Source advisory: MEND:CVE-2025-64530...

@apollo/gateway (>=2.12.0-preview.1, <=2.12.0), @lenne.tech/nest-server (>=11.3.0, <=11.5.0) potentially affected by CVE-2025-64530 via @apollo/composition (>=2.12.0-preview.1, <=2.12.0)

@apollo/composition NPM version =2.12.0-preview.1, =2.12.0-preview.1, =11.3.0, =11.5.0 Source cves: CVE-2025-64530 Source advisory: MEND:CVE-2025-64530...

CVE-2025-64530 @apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields

Apollo Federation is an architecture for declaratively composing APIs into a unified graph. A vulnerability in versions of Apollo Federation's composition logic prior to 2.9.5, 2.10.4, 2.11.5, and 2.12.1 allowed some queries to Apollo Router to improperly bypass access controls on types/fields...