CVE-2026-23897

Apollo Server is an open-source, spec-compliant GraphQL server that's compatible with any GraphQL client, including Apollo Client. In versions from 2.0.0 to 3.13.0, 4.2.0 to before 4.13.0, and 5.0.0 to before 5.4.0, the default configuration of startStandaloneServer from @apollo/server/standalone...

CVE-2026-23897

Apollo Server is an open-source, spec-compliant GraphQL server that's compatible with any GraphQL client, including Apollo Client. In versions from 2.0.0 to 3.13.0, 4.2.0 to before 4.13.0, and 5.0.0 to before 5.4.0, the default configuration of startStandaloneServer from @apollo/server/standalone...

CVE-2026-23897

CVE-2026-23897 affects Apollo Server when using the default configuration of startStandaloneServer from @apollo/server/standalone. Versions 2.0.0–3.13.0, 4.2.0–before 4.13.0, and 5.0.0–before 5.4.0 are vulnerable to Denial of Service via specially crafted request bodies with exotic character set ...

CVE-2026-23897 Apollo Server is vulnerable to denial of service with `startStandaloneServer`

Apollo Server is an open-source, spec-compliant GraphQL server that's compatible with any GraphQL client, including Apollo Client. In versions from 2.0.0 to 3.13.0, 4.2.0 to before 4.13.0, and 5.0.0 to before 5.4.0, the default configuration of startStandaloneServer from @apollo/server/standalone...

EUVD-2026-5364

Apollo Server is an open-source, spec-compliant GraphQL server that's compatible with any GraphQL client, including Apollo Client. In versions from 2.0.0 to 3.13.0, 4.2.0 to before 4.13.0, and 5.0.0 to before 5.4.0, the default configuration of startStandaloneServer from @apollo/server/standalone...

CVE-2026-23897 Apollo Server is vulnerable to denial of service with `startStandaloneServer`

Apollo Server is an open-source, spec-compliant GraphQL server that's compatible with any GraphQL client, including Apollo Client. In versions from 2.0.0 to 3.13.0, 4.2.0 to before 4.13.0, and 5.0.0 to before 5.4.0, the default configuration of startStandaloneServer from @apollo/server/standalone...

CVE-2026-23897 Apollo Server is vulnerable to denial of service with `startStandaloneServer`

Apollo Server is an open-source, spec-compliant GraphQL server that's compatible with any GraphQL client, including Apollo Client. In versions from 2.0.0 to 3.13.0, 4.2.0 to before 4.13.0, and 5.0.0 to before 5.4.0, the default configuration of startStandaloneServer from @apollo/server/standalone...

CVE-2026-23897

Apollo Server is an open-source, spec-compliant GraphQL server that's compatible with any GraphQL client, including Apollo Client. In versions from 2.0.0 to 3.13.0, 4.2.0 to before 4.13.0, and 5.0.0 to before 5.4.0, the default configuration of startStandaloneServer from @apollo/server/standalone...

@apollo/server-integration-testsuite (>=5.0.0, <=5.3.0), @commitspark/graphql-api (>=1.0.0-beta.3, <=1.0.0-beta.6) +19 more potentially affected by CVE-2026-23897 via @apollo/server (>=5.0.0, <=5.3.0)

@apollo/server NPM version =5.0.0, =5.0.0, =1.0.0-beta.3, =1.217.0, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =0.45.8, =1.110.1, =1.117.1 and more Source cves: CVE-2026-23897 Source advisory: MEND:CVE-2026-23897...

@akanjs/nest (>=0.0.4, <=0.0.16), @akanjs/server (>=0.0.4, <=0.0.16) +93 more potentially affected by CVE-2026-23897 via @apollo/server (>=4.2.0, <=4.12.2)

@apollo/server NPM version =4.2.0, =0.0.4, =0.0.4, =1.1.1, =4.2.0, =0.0.1, =2.0.8, =0.2.0, =0.0.2, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.8.8, =1.93.0, =0.3.2, =0.4.0 and more Source cves: CVE-2026-23897 Source advisory: MEND:CVE-2026-23897...

CVE-2026-23897

Apollo Server is an open-source, spec-compliant GraphQL server that's compatible with any GraphQL client, including Apollo Client. In versions from 2.0.0 to 3.13.0, 4.2.0 to before 4.13.0, and 5.0.0 to before 5.4.0, the default configuration of startStandaloneServer from @apollo/server/standalone...

Regular Expression Denial of Service (ReDoS)

Overview @apollo/server is a spec-compliant GraphQL server that's compatible with any GraphQL client, including Apollo Client. Successor to apollo-server-core, et al. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the startStandaloneServer...

Regular Expression Denial of Service (ReDoS)

Overview apollo-server is a Production ready GraphQL Server Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the startStandaloneServer function. An attacker can cause the server to become unresponsive by sending specially crafted request bodies wi...

@akanjs/nest (>=0.0.4, <=0.0.16), @akanjs/server (>=0.0.4, <=0.0.16) +93 more potentially affected by CVE-2026-23897 via @apollo/server (>=4.2.0, <=4.12.2)

@apollo/server NPM version =4.2.0, =0.0.4, =0.0.4, =1.1.1, =4.2.0, =0.0.1, =2.0.8, =0.2.0, =0.0.2, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.8.8, =1.93.0, =0.3.2, =0.4.0 and more Source cves: CVE-2026-23897 Source advisory: OSV:GHSA-MP6Q-XF9X-FWF7...

@apollo/server-integration-testsuite (>=5.0.0, <=5.3.0), @commitspark/graphql-api (>=1.0.0-beta.3, <=1.0.0-beta.6) +19 more potentially affected by CVE-2026-23897 via @apollo/server (>=5.0.0, <=5.3.0)

@apollo/server NPM version =5.0.0, =5.0.0, =1.0.0-beta.3, =1.217.0, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =0.45.8, =1.110.1, =1.117.1 and more Source cves: CVE-2026-23897 Source advisory: OSV:GHSA-MP6Q-XF9X-FWF7...

GHSA-MP6Q-XF9X-FWF7 Apollo Serve vulnerable to Denial of Service with `startStandaloneServer`

Impact The default configuration of startStandaloneServer from @apollo/server/standalone is vulnerable to Denial of Service DoS attacks through specially crafted request bodies with exotic character set encodings. This issue does not affect users that use @apollo/server as a dependency for...

@apollo/server-integration-testsuite (>=5.0.0, <=5.3.0), @commitspark/graphql-api (>=1.0.0-beta.3, <=1.0.0-beta.6) +19 more potentially affected by CVE-2026-23897 via @apollo/server (>=5.0.0, <=5.3.0)

@apollo/server NPM version =5.0.0, =5.0.0, =1.0.0-beta.3, =1.217.0, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =0.45.8, =1.110.1, =1.117.1 and more Source cves: CVE-2026-23897 Source advisory: SNYK:JS-APOLLOSERVER-15208673...

@apollo/server-integration-testsuite (>=5.0.0, <=5.3.0), @commitspark/graphql-api (>=1.0.0-beta.3, <=1.0.0-beta.6) +19 more potentially affected by CVE-2026-23897 via @apollo/server (>=5.0.0, <=5.3.0)

@apollo/server NPM version =5.0.0, =5.0.0, =1.0.0-beta.3, =1.217.0, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =0.45.8, =1.110.1, =1.117.1 and more Source cves: CVE-2026-23897 Source advisory: GHSA-MP6Q-XF9X-FWF7...

Apollo Serve vulnerable to Denial of Service with `startStandaloneServer`

Impact The default configuration of startStandaloneServer from @apollo/server/standalone is vulnerable to Denial of Service DoS attacks through specially crafted request bodies with exotic character set encodings. This issue does not affect users that use @apollo/server as a dependency for...

@akanjs/nest (>=0.0.4, <=0.0.16), @akanjs/server (>=0.0.4, <=0.0.16) +93 more potentially affected by CVE-2026-23897 via @apollo/server (>=4.2.0, <=4.12.2)

@apollo/server NPM version =4.2.0, =0.0.4, =0.0.4, =1.1.1, =4.2.0, =0.0.1, =2.0.8, =0.2.0, =0.0.2, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.8.8, =1.93.0, =0.3.2, =0.4.0 and more Source cves: CVE-2026-23897 Source advisory: GHSA-MP6Q-XF9X-FWF7...