@apollo/server-integration-testsuite (>=5.0.0-rc.0, <=5.3.0), @commitspark/graphql-api (>=1.0.0-beta.3, <=1.0.0-beta.6) +22 more potentially affected by CVE-2026-23897 via @apollo/server (>=5.0.0, <=5.3.0)

@apollo/server NPM version =5.0.0, =5.0.0-rc.0, =1.0.0-beta.3, =1.217.0, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.21.0 and more Source cves: CVE-2026-23897 Source advisory: OSV:GHSA-MP6Q-XF9X-FWF7...

GHSA-MP6Q-XF9X-FWF7 Apollo Serve vulnerable to Denial of Service with `startStandaloneServer`

Impact The default configuration of startStandaloneServer from @apollo/server/standalone is vulnerable to Denial of Service DoS attacks through specially crafted request bodies with exotic character set encodings. This issue does not affect users that use @apollo/server as a dependency for...

@24hr/rawb-search (>=0.5.0, <=0.29.10), @a11ywatch/a11ywatch (>=0.0.1, <=0.3.82) +574 more potentially affected by CVE-2026-23897 via apollo-server (>=2.0.0, <=3.12.0)

apollo-server NPM version =2.0.0, =0.5.0, =0.0.1, =0.1.1, =0.4.0-alpha.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0-SNAPSHOT1, =0.3.0-SNAPSHOT1, =0.3.0-SNAPSHOT1, =0.4.3, =2018.8.29-0, =2018.8.28-0, =2018.10.8-2 and more Source cves: CVE-2026-23897 Source advisory: OSV:GHSA-MP6Q-XF9X-FWF7...

Apollo Serve vulnerable to Denial of Service with `startStandaloneServer`

Impact The default configuration of startStandaloneServer from @apollo/server/standalone is vulnerable to Denial of Service DoS attacks through specially crafted request bodies with exotic character set encodings. This issue does not affect users that use @apollo/server as a dependency for...

PT-2026-6451

Impact The default configuration of startStandaloneServer from @apollo/server/standalone is vulnerable to Denial of Service DoS attacks through specially crafted request bodies with exotic character set encodings. This issue does not affect users that use @apollo/server as a dependency for...

@apollo/server 安全漏洞

@apollo/server is a JavaScript code package open-sourced by Apollo GraphQL. Versions prior to 3.13.0, 4.13.0, and 5.4.0 of @apollo/server contain security vulnerabilities. These vulnerabilities stem from improper handling of encoded requests using special character sets in the default...

CVE-2026-23897: Inefficient Regular Expression Complexity

Apollo Server is an open-source, spec-compliant GraphQL server that's compatible with any GraphQL client, including Apollo Client. In versions from 2.0.0 to 3.13.0, 4.2.0 to before 4.13.0, and 5.0.0 to before 5.4.0, the default configuration of startStandaloneServer from @apollo/server/standalone...

PT-2026-6185

Name of the Vulnerable Software and Affected Versions Apollo Server versions 2.0.0 through 3.13.0 Apollo Server versions 4.2.0 through 4.13.0 Apollo Server versions 5.0.0 through 5.4.0 Description Apollo Server, a GraphQL server, is susceptible to denial of service DoS attacks. This occurs due to...

EUVD-2025-175608

Malicious code in webdriver-mocha-apollo-server-shelljs npm...

EUVD-2025-116572

Malicious code in apollo-server-terser-webpack-plugin-quantum npm...

MAL-2025-139530 Malicious code in apollo-server-terser-webpack-plugin-quantum (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 242351a23e7cfbb27df8dcfbf0a3ce9e20b76ec9c4b6267b770b2fa7c8a05448 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cdo-apollo-server (npm)

The package cdo-apollo-server was found to contain malicious code...

MAL-2025-16695 Malicious code in cdo-apollo-server (npm)

The package cdo-apollo-server was found to contain malicious code...

WS-2023-0313

Apollo Server can log sensitive information Studio API keys if they are passed incorrectly with leading/trailing whitespace or if they have any characters that are invalid as part of a header value...

Information Disclosure

@apollo/server and apollo-server-core are vulnerable to Information Disclosure. The vulnerability is due to a lack sensitive information masking such as Studio API keys which can end up getting logged if they are passed incorrectly with leading/trailing whitespace or if they have any invalid...

@aerogear/apollo-voyager-keycloak (>=0.1.0, <=0.2.7-rc3), @aerogear/apollo-voyager-server (>=0.1.0, <=0.2.7-rc3) +157 more potentially affected by unknown CVE via apollo-server-core (>=2.0.0, <=2.25.3)

apollo-server-core NPM version =2.0.0, =0.1.0, =0.1.0, =0.3.0-SNAPSHOT1, =0.5.0-rc1, =0.3.0-SNAPSHOT1, =0.5.2-dev1, =2018.8.28-0, =0.5.1-alpha.0, =2.11.0, =3.9.0, =2.2.0-alpha.1, =2.3.10, =0.12.0-alpha.3, =0.13.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-J5G3-5C8R-7QFX...

Prevent logging invalid header values

Impact What kind of vulnerability is it? Apollo Server can log sensitive information Studio API keys if they are passed incorrectly with leading/trailing whitespace or if they have any characters that are invalid as part of a header value. Who is impacted? Users who all of the below: use either t...

@ancademy/platform-sdk-client (>=1.1.1, <=1.1.4), @apollo/server-integration-testsuite (>=4.1.0, <=4.9.2) +31 more potentially affected by unknown CVE via @apollo/server (>=4.1.0, <=4.9.2)

@apollo/server NPM version =4.1.0, =1.1.1, =4.1.0, =0.0.1, =3.0.0-alpha.0, =3.0.0-alpha.0, =0.3.0-rc.0, =0.2.0, =0.1.0-alpha.6, =0.1.18, =0.1.17, =0.2.0, =0.1.17, =0.2.0, =0.2.5 and more Source cves: unknown CVE Source advisory: OSV:GHSA-J5G3-5C8R-7QFX...

@a11ywatch/a11ywatch (>=0.0.1, <=0.3.82), @a11ywatch/core (>=0.1.1, <=0.8.17) +49 more potentially affected by unknown CVE via apollo-server-core (>=3.0.0-html.2, <=3.12.0)

apollo-server-core NPM version =3.0.0-html.2, =0.0.1, =0.1.1, =4.9.2, =1.0.1, =1.1.22, =1.1.19, =1.0.0, =1.1.0, =1.0.0, =0.1.0-alpha.0, =0.1.0-alpha.1, =0.1.0-alpha.0, =0.1.0-alpha.0, =0.1.0-alpha.0, =10.0.1, =11.3.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-J5G3-5C8R-7QFX...

Prevent logging invalid header values

Impact What kind of vulnerability is it? Apollo Server can log sensitive information Studio API keys if they are passed incorrectly with leading/trailing whitespace or if they have any characters that are invalid as part of a header value. Who is impacted? Users who all of the below: use either t...