Regular Expression Denial of Service (ReDoS)

Overview @apollo/server is a spec-compliant GraphQL server that's compatible with any GraphQL client, including Apollo Client. Successor to apollo-server-core, et al. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the startStandaloneServer...

Information Exposure

Overview Versions of apollo-server-koa prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations...

@carlosbajo/graphql-gateway (>=2.3.10, <=2.4.62), @egg-type-graphql/egg-graphql (>=2.8.1, <=2.8.3) +19 more potentially affected by unknown CVE via apollo-server-koa (>=2.0.4, <=2.9.12)

apollo-server-koa NPM version =2.0.4, =2.3.10, =2.8.1, =2.4.8, =0.2.1, =0.5.1, =0.2.1, =0.5.1, =0.2.6, =0.1.2, =0.1.6, =0.3.10, =0.3.10, =2.3.7, =2.8.1, =2.8.2 - @openpracticelibrary/strapi-plugin-graphql 3.0.0-beta.20.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W42G-7VFC-XF37...