WS-2020-0115

Apollo-server-micro before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable nam...

Information Disclosure

apollo-server-micro is vulnerable to information disclosure. The vulnerability exists as ApolloServer incorrectly drops the values of this.requestOptions.validationRules when creating a SubscriptionServer...

codelift (>=0.6.3-canary.85.acbf24c.0, <=1.0.15-canary.394.652cc97.0), ra-gen-ui-lib (>=1.0.0-rc.3, <=1.0.0-rc.5) potentially affected by unknown CVE via apollo-server-micro (>=2.9.16, <=2.14.1)

apollo-server-micro NPM version =2.9.16, =0.6.3-canary.85.acbf24c.0, =1.0.0-rc.3, =1.0.0-rc.5 Source cves: unknown CVE Source advisory: OSV:GHSA-W42G-7VFC-XF37...