@apollo/gateway (>=2.3.0-beta.2, <=2.9.5), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.3.0-beta.2, <=2.9.5)

@apollo/query-planner NPM version =2.3.0-beta.2, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: CVE-2026-32621 Source advisory: GHSA-PFJJ-6F4P-RVMH...

@graphql-mesh/plugin-rate-limit (>=0.2.23-alpha-20230403140649-57714f1dd, <=1.0.0), @graphql-mesh/plugin-snapshot (>=0.1.24-alpha-20230403140649-57714f1dd, <=1.0.0) +13 more potentially affected by CVE-2026-27904 via minimatch (>=8.0.2, <=8.0.4)

minimatch NPM version =8.0.2, =0.2.23-alpha-20230403140649-57714f1dd, =0.1.24-alpha-20230403140649-57714f1dd, =0.15.24-alpha-20230403140649-57714f1dd, =2.0.0-beta.0, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =1.6.0-alpha.9, =1.4.1, =1.4.4 Source cves: CVE-2026-27904...

@graphql-mesh/plugin-rate-limit (>=0.2.23-alpha-20230403140649-57714f1dd, <=1.0.0), @graphql-mesh/plugin-snapshot (>=0.1.24-alpha-20230403140649-57714f1dd, <=1.0.0) +13 more potentially affected by CVE-2026-27903 via minimatch (>=8.0.2, <=8.0.4)

minimatch NPM version =8.0.2, =0.2.23-alpha-20230403140649-57714f1dd, =0.1.24-alpha-20230403140649-57714f1dd, =0.15.24-alpha-20230403140649-57714f1dd, =2.0.0-beta.0, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =1.6.0-alpha.9, =1.4.1, =1.4.4 Source cves: CVE-2026-27903...

@graphql-mesh/plugin-rate-limit (>=0.2.23-alpha-20230403140649-57714f1dd, <=1.0.0), @graphql-mesh/plugin-snapshot (>=0.1.24-alpha-20230403140649-57714f1dd, <=1.0.0) +13 more potentially affected by CVE-2026-26996 via minimatch (>=8.0.2, <=8.0.4)

minimatch NPM version =8.0.2, =0.2.23-alpha-20230403140649-57714f1dd, =0.1.24-alpha-20230403140649-57714f1dd, =0.15.24-alpha-20230403140649-57714f1dd, =2.0.0-beta.0, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =1.6.0-alpha.9, =1.4.1, =1.4.4 Source cves: CVE-2026-26996...

@apollo/gateway (>=2.3.0-beta.2, <=2.9.4), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by unknown CVE via @apollo/composition (>=2.3.0-beta.2, <=2.9.4)

@apollo/composition NPM version =2.3.0-beta.2, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: unknown CVE Source advisory: OSV:GHSA-M8JR-FXQX-8XX6...

EUVD-2023-0727

Malicious code in bioql PyPI...

Arbitrary File Access

@graphql-mesh is vulnerable to Arbitrary File Access. The vulnerability is due to a missing validation check in the static file handler, which fails to restrict absolutePath to the designated staticFiles directory, allows attackers to access files outside the intended directory...

CVE-2025-27097

GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. When a user transforms on the root level or single source with...

CVE-2025-27098

GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. Missing check vulnerability in the static file handler allows any...

CVE-2025-27098

GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. Missing check vulnerability in the static file handler allows any...

CVE-2025-27097 Cache variables with the operations when transforms exist on the root level even if variables change in the further requests with the same operation

GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. When a user transforms on the root level or single source with...

CVE-2025-27097 Cache variables with the operations when transforms exist on the root level even if variables change in the further requests with the same operation

GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. When a user transforms on the root level or single source with...

CVE-2025-27097

GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. When a user transforms on the root level or single source with...

CVE-2025-27097 Cache variables with the operations when transforms exist on the root level even if variables change in the further requests with the same operation

GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. When a user transforms on the root level or single source with...

CVE-2025-27097

Affected software: GraphQL Mesh (a GraphQL Federation framework/gateway). The issue stems from the LRU-based cache for DocumentNode used during transforms, causing the initial set of variables to be reused across subsequent requests with different variables. As a result, if tokens are supplied vi...

CVE-2025-27098 Unwanted access to the entire file system vulnerability due to a missing check in `staticFiles` HTTP handler in graphql-mesh

GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. Missing check vulnerability in the static file handler allows any...

CVE-2025-27098

GraphQL Mesh exposes a path traversal vulnerability in its staticFiles handler. When serve.staticFiles is configured, the code path does not reliably constrain absolutePath to the staticFiles directory, allowing access to files outside the intended directory. Affects GraphQL Mesh and related CLI/...

CVE-2025-27098

GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. Missing check vulnerability in the static file handler allows any...

CVE-2025-27098 Unwanted access to the entire file system vulnerability due to a missing check in `staticFiles` HTTP handler in graphql-mesh

GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. Missing check vulnerability in the static file handler allows any...

@accounter-toolkit/green-invoice-graphql (>=0.0.2-alpha-20220914223128-d706aab, <=0.2.0-alpha-20230313141007-4bdbab6), @accounter-toolkit/hashavshevet-mesh (>=0.0.2-alpha-20220915073207-1bb0680, <=0.0.4-alpha-20230313141007-4bdbab6) +11 more potentially affected by CVE-2025-27098 via @graphql-mesh/http (>=0.1.0-alpha-20220905180614-53fadb778, <=0.3.19-alpha-20230216103821-6e078f7e5)

@graphql-mesh/http NPM version =0.1.0-alpha-20220905180614-53fadb778, =0.0.2-alpha-20220914223128-d706aab, =0.0.2-alpha-20220915073207-1bb0680, =0.0.2-alpha-20220914223128-d706aab, =0.2.0-alpha.24, =5.1.0-canary.3, =6.0.0-canary.20, =6.0.0-canary.20, =6.0.0-canary.20,...