CVE-2026-114604

"mergeIncrementalResult" merges an incremental GraphQL response part into an accumulated execution result by walking "'data', ...incrementalResult.path" and assigning at the resolved location. "setObjectKeyPath" tries to reject dangerous segments with strict string equality against "'proto'",...

@adamwdennis/nestjs-typeorm-cursor-pagination (1.0.0), @ambak/nest-logger (>=1.0.11, <=1.1.0) +233 more potentially affected by CVE-2026-114604 via @graphql-tools/utils (>=12.0.0, <=12.0.2-alpha-20260930213106-001ad6da4923b8bb612d81d5418e51f7365e603b)

@graphql-tools/utils NPM version =12.0.0, =1.0.11, =0.0.1, =1.0.0, =1.2.5, =3.1.2, =1.0.8, =1.0.0, =1.0.7, =0.0.1, =1.0.0 - @bune/common 0.0.1 - @cedarjs/api-server-watch 8.0.0-canary.3342 - @cedarjs/cli 8.0.0-canary.3342 - @cedarjs/cli-data-migrate 8.0.0-canary.3342 - @cedarjs/cli-storybook-vite...

DEBIAN-CVE-2026-75507

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specifiedrules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation...

CVE-2026-75508

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's maxtokens limit in Parser.advancelexer counts only non-comment tokens returned after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and...

CVE-2026-75507

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specifiedrules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation...

DEBIAN-CVE-2026-75508

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's maxtokens limit in Parser.advancelexer counts only non-comment tokens returned after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and...

CVE-2026-75507

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specifiedrules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation...

CVE-2026-75508

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's maxtokens limit in Parser.advancelexer counts only non-comment tokens returned after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and...

Prototype Pollution

Overview @graphql-tools/utils is a Common package containing utils and types for GraphQL tools Affected versions of this package are vulnerable to Prototype Pollution via mergeIncrementalResult when path segments are processed by setObjectKeyPath. An attacker can supply a path containing a...

@0day-network/mod-renderer (>=0.1.0, <=0.1.1), @0day-network/react-sdk (>=0.0.1, <=0.2.1) +2104 more potentially affected by CVE-2026-114604 via @graphql-tools/utils (>=10.10.1, <=12.0.1)

@graphql-tools/utils NPM version =10.10.1, =0.1.0, =0.0.1, =1.0.21, =0.9.0, =2.1.2, =0.3.6, =0.4.0, =1.0.0-alpha.0, =1.0.0, =1.1.14, =0.1.1, =0.1.0, =2.10.0, =2.7.0, =2.12.2 and more Source cves: CVE-2026-114604 Source advisory: GHSA-C4QX-W738-7HR3...

@0day-network/mod-renderer (>=0.1.0, <=0.1.1), @0day-network/react-sdk (>=0.0.1, <=0.2.1) +2104 more potentially affected by CVE-2026-114604 via @graphql-tools/utils (>=10.10.1, <=12.0.2-alpha-20260930213106-001ad6da4923b8bb612d81d5418e51f7365e603b)

@graphql-tools/utils NPM version =10.10.1, =0.1.0, =0.0.1, =1.0.21, =0.9.0, =2.1.2, =0.3.6, =0.4.0, =1.0.0-alpha.0, =1.0.0, =1.1.14, =0.1.1, =0.1.0, =2.10.0, =2.7.0, =2.12.2 and more Source cves: CVE-2026-114604 Source advisory: SNYK:JS-GRAPHQLTOOLSUTILS-21460660...

GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

Report metadata | Field | Value | | --- | --- | | Package | @graphql-tools/utils npm, pkg:github/ardatan/graphql-tools | | Repository | https://github.com/ardatan/graphql-tools | | Component | mergeIncrementalResult / setObjectKeyPath packages/utils/src/mergeIncrementalResult.ts | | Vulnerability...

GHSA-C4QX-W738-7HR3 GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

Report metadata | Field | Value | | --- | --- | | Package | @graphql-tools/utils npm, pkg:github/ardatan/graphql-tools | | Repository | https://github.com/ardatan/graphql-tools | | Component | mergeIncrementalResult / setObjectKeyPath packages/utils/src/mergeIncrementalResult.ts | | Vulnerability...

@0day-network/mod-renderer (>=0.1.0, <=0.1.1), @0day-network/react-sdk (>=0.0.1, <=0.2.1) +2104 more potentially affected by CVE-2026-114604 via @graphql-tools/utils (>=10.10.1, <=12.0.2-alpha-20260930213106-001ad6da4923b8bb612d81d5418e51f7365e603b)

@graphql-tools/utils NPM version =10.10.1, =0.1.0, =0.0.1, =1.0.21, =0.9.0, =2.1.2, =0.3.6, =0.4.0, =1.0.0-alpha.0, =1.0.0, =1.1.14, =0.1.1, =0.1.0, =2.10.0, =2.7.0, =2.12.2 and more Source cves: CVE-2026-114604 Source advisory: OSV:GHSA-C4QX-W738-7HR3...

GHSA-R77W-QPH3-7VF8 GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit

Summary The parser's maxtokens limit — the documented defence against oversized GraphQL documents — did not count comment tokens. A document padded with comments could therefore pass a maxtokens check of any size while still allocating one Token object per comment, all of which stay reachable for...

gql (4.3.0b1) potentially affected by CVE-2026-75508 via graphql-core (3.3.0a11)

graphql-core PYPI version 3.3.0a11 is affected by a known vulnerability. The following packages have a transitive dependency on graphql-core and may be impacted: - gql 4.3.0b1 Source cves: CVE-2026-75508 Source advisory: SNYK:PYTHON-GRAPHQLCORE-21433569...

2112-generator-graphql-api (0.0.1), aionto-sdk (>=0.1.0rc1, <=0.1.0rc3) +280 more potentially affected by CVE-2026-75508 via graphql-core (>=3.2.3, <=3.2.11)

graphql-core PYPI version =3.2.3, =0.1.0rc1, =1.0.83, =3.2.2, =0.2.0, =0.3.0, =0.5.0, =2.0.0, =1.0.9, =0.2.0, =0.25.0, =0.1.0rc1, =1.4.0rc1 - baseapp-django-channels-graphql-ws 1.0.0rc9 and more Source cves: CVE-2026-75508 Source advisory: OSV:GHSA-R77W-QPH3-7VF8...

gql (4.3.0b1) potentially affected by CVE-2026-75508 via graphql-core (3.3.0a11)

graphql-core PYPI version 3.3.0a11 is affected by a known vulnerability. The following packages have a transitive dependency on graphql-core and may be impacted: - gql 4.3.0b1 Source cves: CVE-2026-75508 Source advisory: OSV:GHSA-R77W-QPH3-7VF8...

2112-generator-graphql-api (0.0.1), aionto-sdk (>=0.1.0rc1, <=0.1.0rc3) +280 more potentially affected by CVE-2026-75508 via graphql-core (>=3.2.3, <=3.2.11)

graphql-core PYPI version =3.2.3, =0.1.0rc1, =1.0.83, =3.2.2, =0.2.0, =0.3.0, =0.5.0, =2.0.0, =1.0.9, =0.2.0, =0.25.0, =0.1.0rc1, =1.4.0rc1 - baseapp-django-channels-graphql-ws 1.0.0rc9 and more Source cves: CVE-2026-75508 Source advisory: GHSA-R77W-QPH3-7VF8...

GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit

Summary The parser's maxtokens limit — the documented defence against oversized GraphQL documents — did not count comment tokens. A document padded with comments could therefore pass a maxtokens check of any size while still allocating one Token object per comment, all of which stay reachable for...