@10life/strapi-plugin-advanced-cache-manager (>=1.0.1, <=1.0.6), @a11ywatch/a11ywatch (>=0.0.1, <=0.3.82) +52 more potentially affected by unknown CVE via apollo-server-core (>=3.0.0-html.2, <=3.12.1)

apollo-server-core NPM version =3.0.0-html.2, =1.0.1, =0.0.1, =0.1.1, =4.9.2, =1.0.1, =1.1.22, =1.1.19, =1.0.0, =1.1.0, =1.0.0, =0.1.0-alpha.0, =0.1.0-alpha.1, =0.1.0-alpha.0, =0.1.0-alpha.0, =0.1.0-alpha.0, =0.1.14 and more Source cves: unknown CVE Source advisory: OSV:GHSA-9Q82-XGWF-VJ6H...

@apollo/server-integration-testsuite (>=5.0.0-rc.0, <=5.4.0), @commitspark/graphql-api (>=1.0.0-beta.3, <=1.0.0-beta.6) +24 more potentially affected by unknown CVE via @apollo/server (>=5.0.0, <=5.4.0)

@apollo/server NPM version =5.0.0, =5.0.0-rc.0, =1.0.0-beta.3, =1.217.0, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.22.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-9Q82-XGWF-VJ6H...

Apollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention

Impact In a Cross-Site Request Forgery attack, untrusted web content causes browsers to send authenticated requests to web servers which use cookies for authentication. While the web content is prevented from reading the request's response due to the Cross-Origin Request Sharing CORS protocol, an...

GHSA-9Q82-XGWF-VJ6H Apollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention

Impact In a Cross-Site Request Forgery attack, untrusted web content causes browsers to send authenticated requests to web servers which use cookies for authentication. While the web content is prevented from reading the request's response due to the Cross-Origin Request Sharing CORS protocol, an...

EUVD-2026-16175

Apollo Serve vulnerable to Denial of Service with startStandaloneServer...

CVE-2026-32621

Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2, a vulnerability exists in query plan execution within the gateway that may allow pollution of Object.prototype in certain scenarios. A malicious client m...

CVE-2026-32621

Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2, a vulnerability exists in query plan execution within the gateway that may allow pollution of Object.prototype in certain scenarios. A malicious client m...

Apollo Federation 安全漏洞

Apollo Federation is an architecture in the Apollo community that combines APIs into a unified graph through declarative methods. Vulnerabilities exist in versions of Apollo Federation before 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2. These vulnerabilities stem from vulnerabilities in the query...

Malicious code in typescript-vue-apollo-smart-ops (npm)

The package 'typescript-vue-apollo-smart-ops' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

MAL-2026-1555 Malicious code in typescript-vue-apollo-smart-ops (npm)

The package 'typescript-vue-apollo-smart-ops' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

EUVD-2026-12135

Apollo Federation vulnerable to prototype pollution via incomplete key sanitization...

@apollo/composition (>=2.11.0-preview.0, <=2.11.5), @apollo/gateway (>=2.11.0-preview.0, <=2.11.5) +5 more potentially affected by CVE-2026-32621 via @apollo/federation-internals (>=2.11.0, <=2.11.5-preview.1)

@apollo/federation-internals NPM version =2.11.0, =2.11.0-preview.0, =2.11.0-preview.0, =2.11.0-preview.0, =2.11.0-preview.0, =2.11.0-preview.0, =11.1.14, =11.2.0 Source cves: CVE-2026-32621 Source advisory: SNYK:JS-APOLLOFEDERATIONINTERNALS-15612462...

@lenne.tech/nest-server (>=11.3.0, <=11.5.0) potentially affected by CVE-2026-32621 via @apollo/gateway (2.12.0)

@apollo/gateway NPM version 2.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on @apollo/gateway and may be impacted: - @lenne.tech/nest-server =11.3.0, =11.5.0 Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

@apollo/composition (>=2.12.0-preview.0, <=2.12.2), @apollo/gateway (>=2.12.0-preview.0, <=2.12.2) +5 more potentially affected by CVE-2026-32621 via @apollo/federation-internals (>=2.12.0, <=2.12.2)

@apollo/federation-internals NPM version =2.12.0, =2.12.0-preview.0, =2.12.0-preview.0, =2.12.0-preview.0, =2.12.0-preview.0, =2.12.0-preview.0, =11.3.0, =1.0.0, =1.0.13 Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

@apollo/gateway (>=2.3.0-beta.2, <=2.9.5), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.3.0, <=2.9.5)

@apollo/query-planner NPM version =2.3.0, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

@adobe-apimesh/mesh-builder (1.4.0-beta.5), @apollo/composition (>=2.3.0-beta.2, <=2.9.5) +19 more potentially affected by CVE-2026-32621 via @apollo/federation-internals (>=2.3.0, <=2.9.5)

@apollo/federation-internals NPM version =2.3.0, =2.3.0-beta.2, =2.3.0-beta.2, =2.3.0-beta.2, =2.3.0-beta.2, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.10.7-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =3.11.1, =2.8.54, =0.0.0-preview-20230314213245...

@apollo/gateway (>=2.13.0-preview.0, <=2.13.1) potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.13.0, <=2.13.1)

@apollo/query-planner NPM version =2.13.0, =2.13.0-preview.0, =2.13.1 Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

@apollo/gateway (>=2.12.0-preview.0, <=2.12.2), @lenne.tech/nest-server (>=11.3.0, <=11.5.0) potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.12.0, <=2.12.2)

@apollo/query-planner NPM version =2.12.0, =2.12.0-preview.0, =11.3.0, =11.5.0 Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

Apollo Federation vulnerable to prototype pollution via incomplete key sanitization

Impact A vulnerability exists in query plan execution within the gateway that may allow pollution of Object.prototype in certain scenarios. A malicious client may be able to pollute Object.prototype in gateway directly by crafting operations with field aliases and/or variable names that target...

GHSA-PFJJ-6F4P-RVMH Apollo Federation vulnerable to prototype pollution via incomplete key sanitization

Impact A vulnerability exists in query plan execution within the gateway that may allow pollution of Object.prototype in certain scenarios. A malicious client may be able to pollute Object.prototype in gateway directly by crafting operations with field aliases and/or variable names that target...