Prototype Pollution

Overview @apollo/query-planner is an Apollo Query Planner Affected versions of this package are vulnerable to Prototype Pollution through incomplete sanitization of input in the query plan execution. An attacker can manipulate the Object.prototype in the gateway by crafting operations with field...

@apollo/composition (>=2.13.0, <=2.13.1), @apollo/gateway (>=2.13.0, <=2.13.1) +4 more potentially affected by CVE-2026-32621 via @apollo/federation-internals (>=2.13.0, <=2.13.1)

@apollo/federation-internals NPM version =2.13.0, =2.13.0, =2.13.0, =2.13.0, =2.13.0, =2.13.0, =0.0.0, =0.0.2-alpha-20260313130016-7fe861602b61cb29c75e6d7e84eae979268037af Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

@apollo/gateway (>=2.10.0, <=2.10.4), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.10.0, <=2.10.4)

@apollo/query-planner NPM version =2.10.0, =2.10.0, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

CVE-2026-32628

AnythingLLM has a SQL injection in the built‑in SQL Agent plugin (v1.11.1 and earlier) allowing a user who can invoke the agent to run arbitrary SQL on connected databases. The vulnerability stems from getTableSchemaSql() building queries via direct string concatenation of the table_name paramete...

@apollo/gateway (>=2.11.0, <=2.11.5), @dfanchon/gateway (2.11.0) +1 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.11.0, <=2.11.5)

@apollo/query-planner NPM version =2.11.0, =2.11.0, =11.1.14, =11.2.0 Source cves: CVE-2026-32621 Source advisory: MEND:CVE-2026-32621...

@apollo/gateway (>=2.12.0, <=2.12.2), @lenne.tech/nest-server (>=11.3.0, <=11.5.0) potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.12.0, <=2.12.2)

@apollo/query-planner NPM version =2.12.0, =2.12.0, =11.3.0, =11.5.0 Source cves: CVE-2026-32621 Source advisory: MEND:CVE-2026-32621...

CVE-2026-32621

Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2, a vulnerability exists in query plan execution within the gateway that may allow pollution of Object.prototype in certain scenarios. A malicious client m...

@apollo/composition (>=2.11.0, <=2.11.5), @apollo/gateway (>=2.11.0, <=2.11.5) +5 more potentially affected by CVE-2026-32621 via @apollo/federation-internals (>=2.11.0, <=2.11.5)

@apollo/federation-internals NPM version =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =11.1.14, =11.2.0 Source cves: CVE-2026-32621 Source advisory: MEND:CVE-2026-32621...

2mxdev-gql-gateway (1.0.0), @2mxdev/gql-gateway (>=1.0.0, <=4.0.2) +153 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=0.0.11, <=2.9.5)

@apollo/query-planner NPM version =0.0.11, =1.0.0, =0.24.2, =1.0.0, =0.0.1-feature-ci-publish.2, =0.0.1-feature-ci-publish.2, =0.6.5, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.1.1, =1.0.8 and more Source cves: CVE-2026-32621 Source advisory: MEND:CVE-2026-32621...

@apollo/gateway (>=2.10.0, <=2.10.4), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.10.0, <=2.10.4)

@apollo/query-planner NPM version =2.10.0, =2.10.0, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: CVE-2026-32621 Source advisory: MEND:CVE-2026-32621...

@apollo/gateway (>=2.13.0, <=2.13.1) potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.13.0, <=2.13.1)

@apollo/query-planner NPM version =2.13.0, =2.13.0, =2.13.1 Source cves: CVE-2026-32621 Source advisory: MEND:CVE-2026-32621...

CVE-2026-32621

CVE-2026-32621 affects Apollo Federation’s gateway, with a root cause in query plan execution leading to possible pollution of Object.prototype. The advisory and CVE entry indicate the issue exists prior to fixes in versions 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2, involving either crafted oper...

CVE-2026-32621

Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2, a vulnerability exists in query plan execution within the gateway that may allow pollution of Object.prototype in certain scenarios. A malicious client m...

@apollo/composition (>=2.12.0, <=2.12.2), @apollo/gateway (>=2.12.0, <=2.12.2) +5 more potentially affected by CVE-2026-32621 via @apollo/federation-internals (>=2.12.0, <=2.12.2)

@apollo/federation-internals NPM version =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =11.3.0, =1.0.0, =1.0.13 Source cves: CVE-2026-32621 Source advisory: MEND:CVE-2026-32621...

@apollo/composition (>=2.13.0, <=2.13.1), @apollo/gateway (>=2.13.0, <=2.13.1) +4 more potentially affected by CVE-2026-32621 via @apollo/federation-internals (>=2.13.0, <=2.13.1)

@apollo/federation-internals NPM version =2.13.0, =2.13.0, =2.13.0, =2.13.0, =2.13.0, =2.13.0, =0.0.0, =0.0.2-alpha-20260313130016-7fe861602b61cb29c75e6d7e84eae979268037af Source cves: CVE-2026-32621 Source advisory: MEND:CVE-2026-32621...

CVE-2026-32621 Apollo Federation has prototype pollution via incomplete key sanitization

Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2, a vulnerability exists in query plan execution within the gateway that may allow pollution of Object.prototype in certain scenarios. A malicious client m...

GHSA-P2X3-8689-CWPG Parse Server's GraphQL WebSocket endpoint bypasses security middleware

Impact Any Parse Server deployment that uses the GraphQL API is affected. The GraphQL WebSocket endpoint for subscriptions does not pass requests through the Express middleware chain that enforces authentication, introspection control, and query complexity limits. An attacker can connect to the...

Parse Server's GraphQL WebSocket endpoint bypasses security middleware

Impact Any Parse Server deployment that uses the GraphQL API is affected. The GraphQL WebSocket endpoint for subscriptions does not pass requests through the Express middleware chain that enforces authentication, introspection control, and query complexity limits. An attacker can connect to the...

CVE-2026-32594

Parse Server vulnerability CVE-2026-32594 affects the GraphQL WebSocket endpoint used for subscriptions, where requests bypass the Express middleware that enforces authentication, introspection control, and query complexity limits. Prior to versions 8.6.40 and 9.6.0-alpha.14, an attacker could co...

CVE-2026-32594 Parse Server GraphQL WebSocket endpoint bypasses security middleware

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.40 and 9.6.0-alpha.14, the GraphQL WebSocket endpoint for subscriptions does not pass requests through the Express middleware chain that enforces authentication, introspection...