@apollo/gateway (>=2.3.0-beta.2, <=2.9.5), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.3.0-beta.2, <=2.9.5)

@apollo/query-planner NPM version =2.3.0-beta.2, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

@apollo/gateway (>=2.11.0-preview.0, <=2.11.5), @dfanchon/gateway (2.11.0) +1 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.11.0-preview.0, <=2.11.5)

@apollo/query-planner NPM version =2.11.0-preview.0, =2.11.0-preview.0, =11.1.14, =11.2.0 Source cves: CVE-2026-32621 Source advisory: SNYK:JS-APOLLOQUERYPLANNER-15612460...

@apollo/gateway (>=2.12.0, <=2.12.2), @lenne.tech/nest-server (>=11.3.0, <=11.5.0) potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.12.0, <=2.12.2)

@apollo/query-planner NPM version =2.12.0, =2.12.0, =11.3.0, =11.5.0 Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

@apollo/gateway (>=2.13.0, <=2.13.1) potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.13.0, <=2.13.1)

@apollo/query-planner NPM version =2.13.0, =2.13.0, =2.13.1 Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

@apollo/gateway (>=2.11.0, <=2.11.5), @dfanchon/gateway (2.11.0) +1 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.11.0, <=2.11.5)

@apollo/query-planner NPM version =2.11.0, =2.11.0, =11.1.14, =11.2.0 Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

@apollo/gateway (>=2.13.0-preview.0, <=2.13.1) potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.13.0-preview.0, <=2.13.1)

@apollo/query-planner NPM version =2.13.0-preview.0, =2.13.0-preview.0, =2.13.1 Source cves: CVE-2026-32621 Source advisory: SNYK:JS-APOLLOQUERYPLANNER-15612460...

@apollo/composition (>=2.12.0, <=2.12.2), @apollo/gateway (>=2.12.0, <=2.12.2) +5 more potentially affected by CVE-2026-32621 via @apollo/federation-internals (>=2.12.0, <=2.12.2)

@apollo/federation-internals NPM version =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =11.3.0, =1.0.0, =1.0.13 Source cves: CVE-2026-32621 Source advisory: GHSA-PFJJ-6F4P-RVMH...

@apollo/composition (>=2.11.0-preview.0, <=2.11.5), @apollo/gateway (>=2.11.0-preview.0, <=2.11.5) +5 more potentially affected by CVE-2026-32621 via @apollo/federation-internals (>=2.11.0-preview.0, <=2.11.5)

@apollo/federation-internals NPM version =2.11.0-preview.0, =2.11.0-preview.0, =2.11.0-preview.0, =2.11.0-preview.0, =2.11.0-preview.0, =2.11.0-preview.0, =11.1.14, =11.2.0 Source cves: CVE-2026-32621 Source advisory: SNYK:JS-APOLLOFEDERATIONINTERNALS-15612462...

@apollo/gateway (>=2.3.0-beta.2, <=2.9.5), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.3.0-beta.2, <=2.9.5)

@apollo/query-planner NPM version =2.3.0-beta.2, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: CVE-2026-32621 Source advisory: SNYK:JS-APOLLOQUERYPLANNER-15612460...

@apollo/gateway (>=2.3.0-beta.2, <=2.9.5), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.3.0-beta.2, <=2.9.5)

@apollo/query-planner NPM version =2.3.0-beta.2, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: CVE-2026-32621 Source advisory: GHSA-PFJJ-6F4P-RVMH...

@apollo/gateway (>=2.11.0, <=2.11.5), @dfanchon/gateway (2.11.0) +1 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.11.0, <=2.11.5)

@apollo/query-planner NPM version =2.11.0, =2.11.0, =11.1.14, =11.2.0 Source cves: CVE-2026-32621 Source advisory: GHSA-PFJJ-6F4P-RVMH...

@apollo/composition (>=2.11.0, <=2.11.5), @apollo/gateway (>=2.11.0, <=2.11.5) +5 more potentially affected by CVE-2026-32621 via @apollo/federation-internals (>=2.11.0, <=2.11.5)

@apollo/federation-internals NPM version =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =11.1.14, =11.2.0 Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

@apollo/composition (>=2.11.0, <=2.11.5), @apollo/gateway (>=2.11.0, <=2.11.5) +5 more potentially affected by CVE-2026-32621 via @apollo/federation-internals (>=2.11.0, <=2.11.5)

@apollo/federation-internals NPM version =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =11.1.14, =11.2.0 Source cves: CVE-2026-32621 Source advisory: GHSA-PFJJ-6F4P-RVMH...

@apollo/composition (>=2.12.0-preview.0, <=2.12.2), @apollo/gateway (>=2.12.0-preview.0, <=2.12.2) +5 more potentially affected by CVE-2026-32621 via @apollo/federation-internals (>=2.12.0-preview.0, <=2.12.2)

@apollo/federation-internals NPM version =2.12.0-preview.0, =2.12.0-preview.0, =2.12.0-preview.0, =2.12.0-preview.0, =2.12.0-preview.0, =2.12.0-preview.0, =11.3.0, =1.0.0, =1.0.13 Source cves: CVE-2026-32621 Source advisory: SNYK:JS-APOLLOFEDERATIONINTERNALS-15612462...

@apollo/gateway (>=2.10.0-alpha.0, <=2.10.4), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.10.0-alpha.0, <=2.10.4)

@apollo/query-planner NPM version =2.10.0-alpha.0, =2.10.0-alpha.0, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: CVE-2026-32621 Source advisory: SNYK:JS-APOLLOQUERYPLANNER-15612460...

@apollo/gateway (>=2.10.0, <=2.10.4), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.10.0, <=2.10.4)

@apollo/query-planner NPM version =2.10.0, =2.10.0, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: CVE-2026-32621 Source advisory: GHSA-PFJJ-6F4P-RVMH...

Prototype Pollution

Overview @apollo/query-planner is an Apollo Query Planner Affected versions of this package are vulnerable to Prototype Pollution through incomplete sanitization of input in the query plan execution. An attacker can manipulate the Object.prototype in the gateway by crafting operations with field...

@apollo/composition (>=2.13.0, <=2.13.1), @apollo/gateway (>=2.13.0, <=2.13.1) +4 more potentially affected by CVE-2026-32621 via @apollo/federation-internals (>=2.13.0, <=2.13.1)

@apollo/federation-internals NPM version =2.13.0, =2.13.0, =2.13.0, =2.13.0, =2.13.0, =2.13.0, =0.0.0, =0.0.2-alpha-20260313130016-7fe861602b61cb29c75e6d7e84eae979268037af Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

@apollo/gateway (>=2.10.0, <=2.10.4), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.10.0, <=2.10.4)

@apollo/query-planner NPM version =2.10.0, =2.10.0, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

CVE-2026-32628

AnythingLLM has a SQL injection in the built‑in SQL Agent plugin (v1.11.1 and earlier) allowing a user who can invoke the agent to run arbitrary SQL on connected databases. The vulnerability stems from getTableSchemaSql() building queries via direct string concatenation of the table_name paramete...