@apollo/gateway (>=2.12.0-preview.1, <=2.12.0), @lenne.tech/nest-server (>=11.3.0, <=11.5.0) potentially affected by CVE-2025-64530 via @apollo/composition (>=2.12.0-preview.1, <=2.12.0)

@apollo/composition NPM version =2.12.0-preview.1, =2.12.0-preview.1, =11.3.0, =11.5.0 Source cves: CVE-2025-64530 Source advisory: OSV:GHSA-MX7M-J9XF-62HW...

@apollo/gateway (>=2.3.0-beta.2, <=2.9.4), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by CVE-2025-64530 via @apollo/composition (>=2.3.0-beta.2, <=2.9.4)

@apollo/composition NPM version =2.3.0-beta.2, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: CVE-2025-64530 Source advisory: SNYK:JS-APOLLOCOMPOSITION-13961119...

Authentication Bypass Using an Alternate Path or Channel

Overview @apollo/composition is an Apollo Federation composition utilities Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel. An attacker can gain unauthorized access to restricted interface types or fields by crafting queries that target...

@apollo/gateway (>=2.10.0-alpha.0, <=2.10.3), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by CVE-2025-64530 via @apollo/composition (>=2.10.0-alpha.0, <=2.10.3)

@apollo/composition NPM version =2.10.0-alpha.0, =2.10.0-alpha.0, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: CVE-2025-64530 Source advisory: SNYK:JS-APOLLOCOMPOSITION-13961119...

@apollo/gateway (>=2.12.0-preview.0, <=2.12.0), @lenne.tech/nest-server (>=11.3.0, <=11.5.0) potentially affected by CVE-2025-64530 via @apollo/composition (>=2.12.0-preview.0, <=2.12.0)

@apollo/composition NPM version =2.12.0-preview.0, =2.12.0-preview.0, =11.3.0, =11.5.0 Source cves: CVE-2025-64530 Source advisory: SNYK:JS-APOLLOCOMPOSITION-13961119...

@apollo/gateway (>=2.11.0-preview.0, <=2.11.5-preview.1), @dfanchon/gateway (2.11.0) +1 more potentially affected by CVE-2025-64530 via @apollo/composition (>=2.11.0-preview.0, <=2.11.5-preview.1)

@apollo/composition NPM version =2.11.0-preview.0, =2.11.0-preview.0, =11.1.14, =11.2.0 Source cves: CVE-2025-64530 Source advisory: SNYK:JS-APOLLOCOMPOSITION-13961119...

PT-2025-62953

Summary A vulnerability in Apollo Federation's composition logic did not enforce that fields depending on protected data through @requires and/or @fromContext directives have the same access control requirements as the fields they reference. This allowed queries to access protected fields...

CVE-2025-64530

Apollo Federation is an architecture for declaratively composing APIs into a unified graph. A vulnerability in versions of Apollo Federation's composition logic prior to 2.9.5, 2.10.4, 2.11.5, and 2.12.1 allowed some queries to Apollo Router to improperly bypass access controls on types/fields...

CVE-2025-64530

Apollo Federation is an architecture for declaratively composing APIs into a unified graph. A vulnerability in versions of Apollo Federation's composition logic prior to 2.9.5, 2.10.4, 2.11.5, and 2.12.1 allowed some queries to Apollo Router to improperly bypass access controls on types/fields...

@apollo/gateway (>=2.12.0-preview.1, <=2.12.0), @lenne.tech/nest-server (>=11.3.0, <=11.5.0) potentially affected by CVE-2025-64530 via @apollo/composition (>=2.12.0-preview.1, <=2.12.0)

@apollo/composition NPM version =2.12.0-preview.1, =2.12.0-preview.1, =11.3.0, =11.5.0 Source cves: CVE-2025-64530 Source advisory: MEND:CVE-2025-64530...

@apollo/gateway (>=2.11.0-preview.1, <=2.11.5-preview.1), @dfanchon/gateway (2.11.0) +1 more potentially affected by CVE-2025-64530 via @apollo/composition (>=2.11.0-preview.1, <=2.11.5-preview.1)

@apollo/composition NPM version =2.11.0-preview.1, =2.11.0-preview.1, =11.1.14, =11.2.0 Source cves: CVE-2025-64530 Source advisory: MEND:CVE-2025-64530...

CVE-2025-64530 @apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields

Apollo Federation is an architecture for declaratively composing APIs into a unified graph. A vulnerability in versions of Apollo Federation's composition logic prior to 2.9.5, 2.10.4, 2.11.5, and 2.12.1 allowed some queries to Apollo Router to improperly bypass access controls on types/fields...

CVE-2025-64530 @apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields

Apollo Federation is an architecture for declaratively composing APIs into a unified graph. A vulnerability in versions of Apollo Federation's composition logic prior to 2.9.5, 2.10.4, 2.11.5, and 2.12.1 allowed some queries to Apollo Router to improperly bypass access controls on types/fields...

@apollo/gateway (>=2.10.0-alpha.3, <=2.10.3), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by CVE-2025-64530 via @apollo/composition (>=2.10.0-alpha.3, <=2.10.3)

@apollo/composition NPM version =2.10.0-alpha.3, =2.10.0-alpha.3, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: CVE-2025-64530 Source advisory: MEND:CVE-2025-64530...

@apollo/gateway (>=2.3.0-beta.2, <=2.9.4), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by CVE-2025-64530 via @apollo/composition (>=2.3.0-beta.2, <=2.9.4)

@apollo/composition NPM version =2.3.0-beta.2, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: CVE-2025-64530 Source advisory: MEND:CVE-2025-64530...

CVE-2025-64530

The CVE describes a vulnerability in Apollo Federation’s composition logic: in versions prior to 2.9.5, 2.10.4, 2.11.5, and 2.12.1, queries could bypass access controls on interface types/fields by querying implementing object types/fields via inline fragments, due to user-defined access control ...

CVE-2025-64530 @apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields

Apollo Federation is an architecture for declaratively composing APIs into a unified graph. A vulnerability in versions of Apollo Federation's composition logic prior to 2.9.5, 2.10.4, 2.11.5, and 2.12.1 allowed some queries to Apollo Router to improperly bypass access controls on types/fields...

EUVD-2025-176676

Malicious code in resolvers-heliophysics-apollo-cli npm...

Malicious code in dotenv-hexo-apollo-cryonics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 199267a35ed5937ef5f63c6920324dae39fe64bc54a1dd7c5dc19a3157ede4a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185509 Malicious code in apollo-spinner-solis-rigel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d92bc8e061659af9912ea6207249e0e7d6993cab9fd076885c4a2971c386498 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...