WS-2020-0116

Apollo-server-lambda before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable...

8base-cli (>=0.0.80, <=0.0.90), @awoyotoyin/ts-graphql-yoga-express-starter (1.0.0) +133 more potentially affected by unknown CVE via apollo-server-lambda (>=1.3.2, <=2.11.0)

apollo-server-lambda NPM version =1.3.2, =0.0.80, =0.1.0-latest.30e51283, =0.1.0, =0.1.1, =1.0.0, =0.0.1-beta, =1.0.0, =1.7.0, =0.0.4, =0.0.1, =0.0.1-alpha.13, =0.0.1-alpha.12, =0.0.1-alpha.12.5 and more Source cves: unknown CVE Source advisory: MEND:WS-2020-0116...

Information Exposure

Overview Versions of apollo-server-lambda prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relatio...

@forecastr/api (>=0.0.4, <=0.0.5), @hammerframework/api (>=0.0.1-alpha.13, <=0.0.1-alpha.14) +8 more potentially affected by unknown CVE via apollo-server-lambda (>=2.0.0-xrc.11, <=2.11.0)

apollo-server-lambda NPM version =2.0.0-xrc.11, =0.0.4, =0.0.1-alpha.13, =0.0.1-alpha.12, =1.1.0, =0.0.1-alpha.27, =1.0.0, =1.2.1 - photos-production-api 1.0.0 - redwood-express-api 0.8.1 Source cves: unknown CVE Source advisory: OSV:GHSA-W42G-7VFC-XF37...

@forecastr/api (>=0.0.4, <=0.0.5), @hammerframework/api (>=0.0.1-alpha.13, <=0.0.1-alpha.14) +8 more potentially affected by unknown CVE via apollo-server-lambda (>=2.0.0-xrc.11, <=2.11.0)

apollo-server-lambda NPM version =2.0.0-xrc.11, =0.0.4, =0.0.1-alpha.13, =0.0.1-alpha.12, =1.1.0, =0.0.1-alpha.27, =1.0.0, =1.2.1 - photos-production-api 1.0.0 - redwood-express-api 0.8.1 Source cves: unknown CVE Source advisory: GHSA-W42G-7VFC-XF37...