@apollo/gateway (>=2.11.0-preview.1, <=2.11.5-preview.1), @dfanchon/gateway (2.11.0) +1 more potentially affected by unknown CVE via @apollo/composition (>=2.11.0-preview.1, <=2.11.5-preview.1)

@apollo/composition NPM version =2.11.0-preview.1, =2.11.0-preview.1, =11.1.14, =11.2.0 Source cves: unknown CVE Source advisory: GHSA-M8JR-FXQX-8XX6...

@apollo/gateway (>=2.12.0-preview.0, <=2.12.0), @lenne.tech/nest-server (>=11.3.0, <=11.5.0) potentially affected by unknown CVE via @apollo/composition (>=2.12.0-preview.0, <=2.12.0)

@apollo/composition NPM version =2.12.0-preview.0, =2.12.0-preview.0, =11.3.0, =11.5.0 Source cves: unknown CVE Source advisory: OSV:GHSA-M8JR-FXQX-8XX6...

@apollo/gateway (>=2.12.0-preview.0, <=2.12.0), @lenne.tech/nest-server (>=11.3.0, <=11.5.0) potentially affected by unknown CVE via @apollo/composition (>=2.12.0-preview.0, <=2.12.0)

@apollo/composition NPM version =2.12.0-preview.0, =2.12.0-preview.0, =11.3.0, =11.5.0 Source cves: unknown CVE Source advisory: GHSA-M8JR-FXQX-8XX6...

Apollo Federation has Improper Enforcement of Access Control on Transitive Fields

Summary A vulnerability in Apollo Federation's composition logic did not enforce that fields depending on protected data through @requires and/or @fromContext directives have the same access control requirements as the fields they reference. This allowed queries to access protected fields...

EUVD-2025-197661

Apollo Federation has Improper Enforcement of Access Control on Transitive Fields...

GHSA-M8JR-FXQX-8XX6 Apollo Federation has Improper Enforcement of Access Control on Transitive Fields

Summary A vulnerability in Apollo Federation's composition logic did not enforce that fields depending on protected data through @requires and/or @fromContext directives have the same access control requirements as the fields they reference. This allowed queries to access protected fields...

Incorrect Authorization

Overview @apollo/composition is an Apollo Federation composition utilities Affected versions of this package are vulnerable to Incorrect Authorization via the composition logic, which failed to validate that fields have the same access control requirements as the data they reference. An attacker...

@apollo/gateway (>=2.3.0-beta.2, <=2.9.4), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by unknown CVE via @apollo/composition (>=2.3.0-beta.2, <=2.9.4)

@apollo/composition NPM version =2.3.0-beta.2, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: unknown CVE Source advisory: GHSA-M8JR-FXQX-8XX6...

@apollo/gateway (>=2.10.0-alpha.0, <=2.10.3), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by CVE-2025-64172 via @apollo/composition (>=2.10.0-alpha.0, <=2.10.3)

@apollo/composition NPM version =2.10.0-alpha.0, =2.10.0-alpha.0, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: CVE-2025-64172 Source advisory: SNYK:JS-APOLLOCOMPOSITION-14038234...

@apollo/gateway (>=2.10.0-alpha.3, <=2.10.3), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by unknown CVE via @apollo/composition (>=2.10.0-alpha.3, <=2.10.3)

@apollo/composition NPM version =2.10.0-alpha.3, =2.10.0-alpha.3, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: unknown CVE Source advisory: OSV:GHSA-M8JR-FXQX-8XX6...

GHSA-MX7M-J9XF-62HW @apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields

Summary A vulnerability in Apollo Federation's composition logic allowed some queries to Apollo Router to improperly bypass access controls on types/fields. Apollo Federation incorrectly allowed user-defined access control directives on interface types/fields, which could be bypassed by instead...

@apollo/gateway (>=2.10.0-alpha.3, <=2.10.3), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by CVE-2025-64530 via @apollo/composition (>=2.10.0-alpha.3, <=2.10.3)

@apollo/composition NPM version =2.10.0-alpha.3, =2.10.0-alpha.3, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: CVE-2025-64530 Source advisory: GHSA-MX7M-J9XF-62HW...

@apollo/gateway (>=2.10.0-alpha.3, <=2.10.3), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by CVE-2025-64530 via @apollo/composition (>=2.10.0-alpha.3, <=2.10.3)

@apollo/composition NPM version =2.10.0-alpha.3, =2.10.0-alpha.3, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: CVE-2025-64530 Source advisory: OSV:GHSA-MX7M-J9XF-62HW...

@apollo/gateway (>=2.3.0-beta.2, <=2.9.4), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by CVE-2025-64530 via @apollo/composition (>=2.3.0-beta.2, <=2.9.4)

@apollo/composition NPM version =2.3.0-beta.2, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: CVE-2025-64530 Source advisory: OSV:GHSA-MX7M-J9XF-62HW...

EUVD-2025-180542

@apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields...

@apollo/gateway (>=2.11.0-preview.1, <=2.11.5-preview.1), @dfanchon/gateway (2.11.0) +1 more potentially affected by CVE-2025-64530 via @apollo/composition (>=2.11.0-preview.1, <=2.11.5-preview.1)

@apollo/composition NPM version =2.11.0-preview.1, =2.11.0-preview.1, =11.1.14, =11.2.0 Source cves: CVE-2025-64530 Source advisory: GHSA-MX7M-J9XF-62HW...

@apollo/gateway (>=2.11.0-preview.1, <=2.11.5-preview.1), @dfanchon/gateway (2.11.0) +1 more potentially affected by CVE-2025-64530 via @apollo/composition (>=2.11.0-preview.1, <=2.11.5-preview.1)

@apollo/composition NPM version =2.11.0-preview.1, =2.11.0-preview.1, =11.1.14, =11.2.0 Source cves: CVE-2025-64530 Source advisory: OSV:GHSA-MX7M-J9XF-62HW...

@apollo/gateway (>=2.3.0-beta.2, <=2.9.4), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by CVE-2025-64530 via @apollo/composition (>=2.3.0-beta.2, <=2.9.4)

@apollo/composition NPM version =2.3.0-beta.2, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: CVE-2025-64530 Source advisory: GHSA-MX7M-J9XF-62HW...

@apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields

Summary A vulnerability in Apollo Federation's composition logic allowed some queries to Apollo Router to improperly bypass access controls on types/fields. Apollo Federation incorrectly allowed user-defined access control directives on interface types/fields, which could be bypassed by instead...

@apollo/gateway (>=2.12.0-preview.1, <=2.12.0), @lenne.tech/nest-server (>=11.3.0, <=11.5.0) potentially affected by CVE-2025-64530 via @apollo/composition (>=2.12.0-preview.1, <=2.12.0)

@apollo/composition NPM version =2.12.0-preview.1, =2.12.0-preview.1, =11.3.0, =11.5.0 Source cves: CVE-2025-64530 Source advisory: GHSA-MX7M-J9XF-62HW...