@ancademy/platform-sdk-client (>=1.1.1, <=1.1.4), @apollo/server-integration-testsuite (>=4.1.0, <=4.9.2) +31 more potentially affected by unknown CVE via @apollo/server (>=4.1.0, <=4.9.2)

@apollo/server NPM version =4.1.0, =1.1.1, =4.1.0, =0.0.1, =3.0.0-alpha.0, =3.0.0-alpha.0, =0.3.0-rc.0, =0.2.0, =0.1.0-alpha.6, =0.1.18, =0.1.17, =0.2.0, =0.1.17, =0.2.0, =0.2.5 and more Source cves: unknown CVE Source advisory: GHSA-J5G3-5C8R-7QFX...

@ancademy/platform-sdk-client (>=1.1.1, <=1.1.4), @apollo/server-integration-testsuite (>=4.1.0, <=4.9.2) +31 more potentially affected by unknown CVE via @apollo/server (>=4.1.0, <=4.9.2)

@apollo/server NPM version =4.1.0, =1.1.1, =4.1.0, =0.0.1, =3.0.0-alpha.0, =3.0.0-alpha.0, =0.3.0-rc.0, =0.2.0, =0.1.0-alpha.6, =0.1.18, =0.1.17, =0.2.0, =0.1.17, =0.2.0, =0.2.5 and more Source cves: unknown CVE Source advisory: OSV:GHSA-J5G3-5C8R-7QFX...

PT-2023-33035 · Unknown · Apollo Server

Name of the Vulnerable Software and Affected Versions: Apollo Server versions prior to the latest version Description: The issue concerns Apollo Server logging sensitive information, specifically Studio API keys, under certain conditions. This occurs when API keys are passed with leading or...

Prevent logging invalid header values

Impact What kind of vulnerability is it? Apollo Server can log sensitive information Studio API keys if they are passed incorrectly with leading/trailing whitespace or if they have any characters that are invalid as part of a header value. Who is impacted? Users who all of the below: use either t...

WS-2023-0175

There aren't any XSS attack vectors via the Apollo Server landing pages known to Apollo, so to our knowledge there is no impact. However, if there are existing XSS vectors that haven't been reported and patched, then all users of Apollo Server's landing pages have a vulnerability which won't be...

GHSA-68JH-RF6X-836F @apollo/server vulnerable to unsafe application of Content Security Policy via reused nonces

Context Content Security Policies CSP are a defense-in-depth strategy against XSS attacks. Improper application of CSP isn't itself a vulnerability, but it does fail to prevent XSS in the event that there is a viable attack vector for an XSS attack. Impact There aren't any XSS attack vectors via...

@apollo/server vulnerable to unsafe application of Content Security Policy via reused nonces

Context Content Security Policies CSP are a defense-in-depth strategy against XSS attacks. Improper application of CSP isn't itself a vulnerability, but it does fail to prevent XSS in the event that there is a viable attack vector for an XSS attack. Impact There aren't any XSS attack vectors via...

@apollo/server-integration-testsuite (>=4.7.1, <=4.7.3), @athenajs/core (>=0.0.1, <=0.0.17) +4 more potentially affected by unknown CVE via @apollo/server (>=4.7.1, <=4.7.3)

@apollo/server NPM version =4.7.1, =4.7.1, =0.0.1, =0.5.0-rc.0, =0.0.1, =0.0.1, =0.0.3 Source cves: unknown CVE Source advisory: OSV:GHSA-68JH-RF6X-836F...

@apollo/server-integration-testsuite (>=4.7.1, <=4.7.3), @athenajs/core (>=0.0.1, <=0.0.17) +4 more potentially affected by unknown CVE via @apollo/server (>=4.7.1, <=4.7.3)

@apollo/server NPM version =4.7.1, =4.7.1, =0.0.1, =0.5.0-rc.0, =0.0.1, =0.0.1, =0.0.3 Source cves: unknown CVE Source advisory: GHSA-68JH-RF6X-836F...

PT-2023-32982 · Apollo Graphql · Apollo Server

Name of the Vulnerable Software and Affected Versions: Apollo Server versions prior to 4.7.4 Description: The issue concerns the improper application of Content Security Policies CSP in Apollo Server's landing pages, which could fail to prevent XSS attacks if a viable attack vector exists. Althou...

HTTP Request Smuggling

apollo-server is vulnerable to HTTP request smuggling. The vulnerability exists because the library does not properly set the cache-control response header in the batched HTTP requests, allowing an attacker to smuggle HTTP requests...

WS-2022-0362

In Apollo Server 3 and 4, the "cache-control" HTTP response header may not reflect the cache policy that should apply to an HTTP request when that HTTP request contains multiple operations using HTTP batching. This could lead to data being inappropriately cached and shared. Apollo Server allows...

@a11ywatch/a11ywatch (>=0.0.1, <=0.1.65), @a11ywatch/core (>=0.1.1, <=0.5.158) +27 more potentially affected by unknown CVE via apollo-server-core (>=3.1.2, <=3.10.4)

apollo-server-core NPM version =3.1.2, =0.0.1, =0.1.1, =1.0.1, =1.1.22, =1.1.19, =0.1.0-alpha.0, =0.1.0-alpha.0, =0.1.0-alpha.0, =0.1.0-alpha.0, =10.0.1, =4.0.0-alpha.0, =4.0.0-alpha.0, =4.0.0-alpha.20, =0.0.27, =0.0.11, =0.0.16 and more Source cves: unknown CVE Source advisory:...

@a11ywatch/a11ywatch (>=0.0.1, <=0.1.65), @a11ywatch/core (>=0.1.1, <=0.5.158) +27 more potentially affected by unknown CVE via apollo-server-core (>=3.1.2, <=3.10.4)

apollo-server-core NPM version =3.1.2, =0.0.1, =0.1.1, =1.0.1, =1.1.22, =1.1.19, =0.1.0-alpha.0, =0.1.0-alpha.0, =0.1.0-alpha.0, =0.1.0-alpha.0, =10.0.1, =4.0.0-alpha.0, =4.0.0-alpha.0, =4.0.0-alpha.20, =0.0.27, =0.0.11, =0.0.16 and more Source cves: unknown CVE Source advisory: GHSA-8R69-3CVP-WX...

GHSA-8R69-3CVP-WXC3 Batched HTTP requests may set incorrect `cache-control` response header

Impact In Apollo Server 3 and 4, the cache-control HTTP response header may not reflect the cache policy that should apply to an HTTP request when that HTTP request contains multiple operations using HTTP batching. This could lead to data being inappropriately cached and shared. Apollo Server...

Batched HTTP requests may set incorrect `cache-control` response header

Impact In Apollo Server 3 and 4, the cache-control HTTP response header may not reflect the cache policy that should apply to an HTTP request when that HTTP request contains multiple operations using HTTP batching. This could lead to data being inappropriately cached and shared. Apollo Server...

Batched HTTP requests may set incorrect `cache-control` response header

Impact In Apollo Server 3 and 4, the cache-control HTTP response header may not reflect the cache policy that should apply to an HTTP request when that HTTP request contains multiple operations using HTTP batching. This could lead to data being inappropriately cached and shared. Apollo Server...

PT-2022-28222 · Unknown · Apollo Server

Name of the Vulnerable Software and Affected Versions: Apollo Server versions 3.0.0 through 3.10.0 Apollo Server versions 4.0.0 through 4.0.0 Description: The cache-control HTTP response header may not reflect the cache policy for HTTP requests with multiple operations using HTTP batching. This...

WS-2022-0331

The "graphql-upload" https://www.npmjs.com/package/graphql-upload npm package can execute GraphQL operations contained in "content-type: multipart/form-data" POST requests. Because they are POST requests, they can contain GraphQL mutations. Because they use "content-type: multipart/form-data", th...

@24hr/rawb-search (>=0.10.1, <=0.29.10), @aerogear/apollo-voyager-keycloak (>=0.1.0, <=0.2.7-rc3) +79 more potentially affected by unknown CVE via apollo-server (>=2.0.0, <=2.25.3)

apollo-server NPM version =2.0.0, =0.10.1, =0.1.0, =0.1.0, =0.3.0-SNAPSHOT1, =0.5.0-rc1, =0.3.0-SNAPSHOT1, =2018.8.29-0, =2018.8.28-0, =0.5.7, =1.0.0, =0.0.1-alpha.44, =0.4.0, =0.0.0-d99f4ac.0, =1.27.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-2P3C-P3QW-69R4...