CVE-2026-9737

During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure...

SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths

A record user could learn the value of a hidden field by counting how many records match a guess. When DEFINE FIELD ... PERMISSIONS FOR select WHERE ... hides a field's contents from a caller, and that field is indexed, running SELECT count FROM t WHERE hiddenfield = "guess" GROUP ALL returned a...

@apollo/gateway (>=2.3.0-beta.2, <=2.9.5), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.3.0, <=2.9.5)

@apollo/query-planner NPM version =2.3.0, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

@apollo/gateway (>=2.13.0-preview.0, <=2.13.1) potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.13.0, <=2.13.1)

@apollo/query-planner NPM version =2.13.0, =2.13.0-preview.0, =2.13.1 Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

@apollo/gateway (>=2.12.0-preview.0, <=2.12.2), @lenne.tech/nest-server (>=11.3.0, <=11.5.0) potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.12.0, <=2.12.2)

@apollo/query-planner NPM version =2.12.0, =2.12.0-preview.0, =11.3.0, =11.5.0 Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

@apollo/gateway (>=2.11.0-preview.0, <=2.11.5), @dfanchon/gateway (2.11.0) +1 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.11.0, <=2.11.5-preview.1)

@apollo/query-planner NPM version =2.11.0, =2.11.0-preview.0, =11.1.14, =11.2.0 Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

@apollo/gateway (>=2.11.0-preview.0, <=2.11.5), @dfanchon/gateway (2.11.0) +1 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.11.0, <=2.11.5-preview.1)

@apollo/query-planner NPM version =2.11.0, =2.11.0-preview.0, =11.1.14, =11.2.0 Source cves: CVE-2026-32621 Source advisory: SNYK:JS-APOLLOQUERYPLANNER-15612460...

@apollo/composition (>=2.13.0-preview.0, <=2.13.1), @apollo/gateway (>=2.13.0-preview.0, <=2.13.1) +4 more potentially affected by CVE-2026-32621 via @apollo/federation-internals (>=2.13.0, <=2.13.1)

@apollo/federation-internals NPM version =2.13.0, =2.13.0-preview.0, =2.13.0-preview.0, =2.13.0-preview.0, =2.13.0-preview.0, =2.13.0-preview.0, =0.0.0, =0.0.2-alpha-20260313130016-7fe861602b61cb29c75e6d7e84eae979268037af Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

@apollo/gateway (>=2.10.0-alpha.0, <=2.10.4), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.10.0, <=2.10.4)

@apollo/query-planner NPM version =2.10.0, =2.10.0-alpha.0, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

Prototype Pollution

Overview @apollo/query-planner is an Apollo Query Planner Affected versions of this package are vulnerable to Prototype Pollution through incomplete sanitization of input in the query plan execution. An attacker can manipulate the Object.prototype in the gateway by crafting operations with field...

@apollo/gateway (>=2.12.0-preview.0, <=2.12.2), @lenne.tech/nest-server (>=11.3.0, <=11.5.0) potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.12.0, <=2.12.2)

@apollo/query-planner NPM version =2.12.0, =2.12.0-preview.0, =11.3.0, =11.5.0 Source cves: CVE-2026-32621 Source advisory: SNYK:JS-APOLLOQUERYPLANNER-15612460...

@apollo/gateway (>=2.13.0-preview.0, <=2.13.1) potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.13.0, <=2.13.1)

@apollo/query-planner NPM version =2.13.0, =2.13.0-preview.0, =2.13.1 Source cves: CVE-2026-32621 Source advisory: SNYK:JS-APOLLOQUERYPLANNER-15612460...

@apollo/gateway (>=2.3.0-beta.2, <=2.9.5), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.3.0, <=2.9.5)

@apollo/query-planner NPM version =2.3.0, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: CVE-2026-32621 Source advisory: SNYK:JS-APOLLOQUERYPLANNER-15612460...

@apollo/gateway (>=2.10.0-alpha.0, <=2.10.4), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.10.0, <=2.10.4)

@apollo/query-planner NPM version =2.10.0, =2.10.0-alpha.0, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: CVE-2026-32621 Source advisory: SNYK:JS-APOLLOQUERYPLANNER-15612460...

ROS-20260311-73-0008

A vulnerability in the MongoDB Query Planner component of the MongoDB kernel is related to unrestricted resource allocation. Exploitation of the vulnerability could allow a remote attacker to cause a denial-of-service condition...

BIT-MONGODB-2026-25613 An unsafe cast in the MongoDB query planner can result in a segmentation fault.

An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index...

BIT-MONGODB-2026-1850 An authorized user may disable the MongoDB server by issuing a certain type of complex query due to boolean expression simplification

Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash...

The vulnerability of the MongoDB Query Planner component of the MongoDB database engine allows a hacker to cause a service failure.

The vulnerability of the MongoDB Query Planner component in the MongoDB database lies in its unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

MongoDB 8.0.x < 8.0.18 / 8.2.x < 8.2.4 Out-Of-Memory (SERVER-114126)

The version of MongoDB installed on the remote host is 8.0 prior to 8.0.18 and 8.2 prior to 8.2.4. It is, therefore, affected by a vulnerability as referenced in the SERVER-114126 advisory. - Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory...

CVE-2026-1850

Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash...