ROOT-APP-NPM-CVE-2026-104852 CVE-2026-104852 in @graphql-tools/utils - Patched by Root

Root has patched CVE-2026-104852 in the @graphql-tools/utils package for Root:npm. Multiple fixed versions available...

CVE-2026-104852

A flaw was found in @graphql-tools/utils. The mergeDeep function fails to restrict sensitive object properties during recursive data merging, leading to prototype pollution, where fundamental JavaScript object definitions are modified. A remote, unauthenticated attacker can exploit this flaw by...

CLSA-2026-1791291395 TuxCare security update for @graphql-tools/utils (1 CVE)

TuxCare rebuilt @graphql-tools/utils to address 1 CVE. Fixed in 11.2.2-tuxcare.1...

CVE-2026-104852

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude proto, constructor, or prototype keys. An...

@graphql-tools/prisma-loader (>=8.0.0-alpha-20230517123108-df347e95, <=8.0.17-alpha-20241113142246-527bbf8c4e20af3d172439ab4746fe676b3a61c5), @graphql-tools/url-loader (>=8.0.0-alpha-20230517123108-df347e95, <=9.1.8-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4) +1 more potentially affected by CVE-2026-103921 via @graphql-tools/executor-legacy-ws (>=1.0.0-alpha-20230517123108-df347e95, <=1.1.34-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4)

@graphql-tools/executor-legacy-ws NPM version =1.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =9.1.8-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4 - graphql-config 5.0.0-alpha-20230519081831-037f0ba Source cves:...

EUVD-2026-90922

GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor...

GHSA-6FW5-9HQ8-W87G GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

Impact buildWSLegacyExecutor in @graphql-tools/executor-legacy-ws previously hardcoded rejectUnauthorized: false when creating WebSocket connections over WSS. This disabled TLS certificate validation, allowing a network-positioned attacker to perform a Man-in-the-Middle MITM attack against...

GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

Impact buildWSLegacyExecutor in @graphql-tools/executor-legacy-ws previously hardcoded rejectUnauthorized: false when creating WebSocket connections over WSS. This disabled TLS certificate validation, allowing a network-positioned attacker to perform a Man-in-the-Middle MITM attack against...

GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

Closed by https://github.com/ardatan/graphql-tools/pull/8423 Mitigated in Hive Gateway by https://github.com/graphql-hive/gateway/pull/2600 A client can alias fields to constructor, proto or prototype so that the response keys from two subgraphs collide on those names during result merging. Becau...

@adamwdennis/nestjs-typeorm-cursor-pagination (1.0.0), @ambak/nest-logger (>=1.0.11, <=1.1.0) +195 more potentially affected by CVE-2026-104852 via @graphql-tools/utils (12.0.0-alpha-20260811213401-1eff5799faeb287f78dcafd6415e2afe144cee07)

@graphql-tools/utils NPM version 12.0.0-alpha-20260811213401-1eff5799faeb287f78dcafd6415e2afe144cee07 is affected by a known vulnerability. The following packages have a transitive dependency on @graphql-tools/utils and may be impacted: - @adamwdennis/nestjs-typeorm-cursor-pagination 1.0.0 -...

GHSA-7MX3-VVMW-HJMV GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

Closed by https://github.com/ardatan/graphql-tools/pull/8423 Mitigated in Hive Gateway by https://github.com/graphql-hive/gateway/pull/2600 A client can alias fields to constructor, proto or prototype so that the response keys from two subgraphs collide on those names during result merging. Becau...

EUVD-2026-92849

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude proto, constructor, or prototype keys. An...

CVE-2026-104852 GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude proto, constructor, or prototype keys. An...

CVE-2026-104852 GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude proto, constructor, or prototype keys. An...

CVE-2026-104852

The GraphQL Tools utils package is vulnerable to prototype pollution in the mergeDeep function prior to version 12.0.1 . The root cause is that the function follows inherited properties and fails to exclude __proto__, constructor, or prototype keys during recursive merging. An unauthenticated Gra...

CVE-2026-104852 GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude proto, constructor, or prototype keys. An...

PT-2026-106267

Name of the Vulnerable Software and Affected Versions GraphQL Tools versions prior to 12.0.1 Description The mergeDeep function in the GraphQL Tools utils package fails to exclude proto , constructor, or prototype keys while recursively merging source objects. An unauthenticated client can alias...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation via a hardcoded rejectUnauthorized: false in buildWSLegacyExecutor, which unconditionally disables TLS certificate validation for all wss:// connections and cannot be overridden by callers. An attacker...

Improper Certificate Validation

Overview @graphql-tools/executor-legacy-ws is an A set of utils for faster development of GraphQL tools Affected versions of this package are vulnerable to Improper Certificate Validation via a hardcoded rejectUnauthorized: false in buildWSLegacyExecutor, which unconditionally disables TLS...

CVE-2026-103921

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...