ROOT-APP-NPM-CVE-2026-104852 CVE-2026-104852 in @graphql-tools/utils - Patched by Root

Root has patched CVE-2026-104852 in the @graphql-tools/utils package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-103921 CVE-2026-103921 in @graphql-tools/executor-legacy-ws - Patched by Root

Root has patched CVE-2026-103921 in the @graphql-tools/executor-legacy-ws package for Root:npm. Multiple fixed versions available...

CVE-2026-104852

A flaw was found in @graphql-tools/utils. The mergeDeep function fails to restrict sensitive object properties during recursive data merging, leading to prototype pollution, where fundamental JavaScript object definitions are modified. A remote, unauthenticated attacker can exploit this flaw by...

CLSA-2026-1791291395 TuxCare security update for @graphql-tools/utils (1 CVE)

TuxCare rebuilt @graphql-tools/utils to address 1 CVE. Fixed in 11.2.2-tuxcare.1...

Prototype Pollution

Overview @graphql-tools/utils is a Common package containing utils and types for GraphQL tools Affected versions of this package are vulnerable to Prototype Pollution via the mergeDeep function, which fails to block reserved property keys such as proto, constructor, and prototype before recursive...

@adamwdennis/nestjs-typeorm-cursor-pagination (1.0.0), @ambak/nest-logger (>=1.0.11, <=1.1.0) +209 more potentially affected by CVE-2026-104852 via @graphql-tools/utils (>=12.0.0-alpha-20260805121238-f73ffd0c8126377e841d94b8bb2db97f34af4c41, <=12.0.1-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4)

@graphql-tools/utils NPM version =12.0.0-alpha-20260805121238-f73ffd0c8126377e841d94b8bb2db97f34af4c41, =1.0.11, =0.0.1, =1.0.0, =0.0.6, =1.2.5, =2.0.0, =1.0.8, =1.0.0, =1.0.7, =0.0.1, =1.0.0, =0.0.73, =0.0.3, =0.0.44 and more Source cves: CVE-2026-104852 Source advisory:...

PT-2026-115963

TuxCare rebuilt @graphql-tools/utils to address 1 CVE. Fixed in 11.2.2-tuxcare.1...

CVE-2026-104852

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude proto, constructor, or prototype keys. An...

EUVD-2026-90922

GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor...

GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

Impact buildWSLegacyExecutor in @graphql-tools/executor-legacy-ws previously hardcoded rejectUnauthorized: false when creating WebSocket connections over WSS. This disabled TLS certificate validation, allowing a network-positioned attacker to perform a Man-in-the-Middle MITM attack against...

@graphql-tools/prisma-loader (>=8.0.0-alpha-20230517123108-df347e95, <=8.0.17-alpha-20241113142246-527bbf8c4e20af3d172439ab4746fe676b3a61c5), @graphql-tools/url-loader (>=8.0.0-alpha-20230517123108-df347e95, <=9.1.9-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a) +1 more potentially affected by CVE-2026-103921 via @graphql-tools/executor-legacy-ws (>=1.0.0-alpha-20230517123108-df347e95, <=1.1.35-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a)

@graphql-tools/executor-legacy-ws NPM version =1.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =9.1.9-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a - graphql-config 5.0.0-alpha-20230519081831-037f0ba Source cves:...

@graphql-tools/prisma-loader (>=8.0.0-alpha-20230517123108-df347e95, <=8.0.17-alpha-20241113142246-527bbf8c4e20af3d172439ab4746fe676b3a61c5), @graphql-tools/url-loader (>=8.0.0-alpha-20230517123108-df347e95, <=9.1.8-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4) +1 more potentially affected by CVE-2026-103921 via @graphql-tools/executor-legacy-ws (>=1.0.0-alpha-20230517123108-df347e95, <=1.1.34-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4)

@graphql-tools/executor-legacy-ws NPM version =1.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =9.1.8-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4 - graphql-config 5.0.0-alpha-20230519081831-037f0ba Source cves:...

GHSA-6FW5-9HQ8-W87G GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

Impact buildWSLegacyExecutor in @graphql-tools/executor-legacy-ws previously hardcoded rejectUnauthorized: false when creating WebSocket connections over WSS. This disabled TLS certificate validation, allowing a network-positioned attacker to perform a Man-in-the-Middle MITM attack against...

GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

Closed by https://github.com/ardatan/graphql-tools/pull/8423 Mitigated in Hive Gateway by https://github.com/graphql-hive/gateway/pull/2600 A client can alias fields to constructor, proto or prototype so that the response keys from two subgraphs collide on those names during result merging. Becau...

GHSA-7MX3-VVMW-HJMV GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

Closed by https://github.com/ardatan/graphql-tools/pull/8423 Mitigated in Hive Gateway by https://github.com/graphql-hive/gateway/pull/2600 A client can alias fields to constructor, proto or prototype so that the response keys from two subgraphs collide on those names during result merging. Becau...

@adamwdennis/nestjs-typeorm-cursor-pagination (1.0.0), @ambak/nest-logger (>=1.0.11, <=1.1.0) +209 more potentially affected by CVE-2026-104852 via @graphql-tools/utils (>=12.0.0-alpha-20260805121238-f73ffd0c8126377e841d94b8bb2db97f34af4c41, <=12.0.1-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4)

@graphql-tools/utils NPM version =12.0.0-alpha-20260805121238-f73ffd0c8126377e841d94b8bb2db97f34af4c41, =1.0.11, =0.0.1, =1.0.0, =0.0.6, =1.2.5, =2.0.0, =1.0.8, =1.0.0, =1.0.7, =0.0.1, =1.0.0, =0.0.73, =0.0.3, =0.0.44 and more Source cves: CVE-2026-104852 Source advisory: OSV:GHSA-7MX3-VVMW-HJMV...

@adamwdennis/nestjs-typeorm-cursor-pagination (1.0.0), @ambak/nest-logger (>=1.0.11, <=1.1.0) +209 more potentially affected by CVE-2026-104852 via @graphql-tools/utils (>=12.0.0-alpha-20260805121238-f73ffd0c8126377e841d94b8bb2db97f34af4c41, <=12.0.0)

@graphql-tools/utils NPM version =12.0.0-alpha-20260805121238-f73ffd0c8126377e841d94b8bb2db97f34af4c41, =1.0.11, =0.0.1, =1.0.0, =0.0.6, =1.2.5, =2.0.0, =1.0.8, =1.0.0, =1.0.7, =0.0.1, =1.0.0, =0.0.73, =0.0.3, =0.0.44 and more Source cves: CVE-2026-104852 Source advisory: GHSA-7MX3-VVMW-HJMV...

EUVD-2026-92849

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude proto, constructor, or prototype keys. An...

CVE-2026-104852 GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude proto, constructor, or prototype keys. An...

CVE-2026-104852

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude proto, constructor, or prototype keys. An...