CVE-2026-114604

"mergeIncrementalResult" merges an incremental GraphQL response part into an accumulated execution result by walking "'data', ...incrementalResult.path" and assigning at the resolved location. "setObjectKeyPath" tries to reject dangerous segments with strict string equality against "'proto'",...