p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de @graphql-tools/utils

Vulnerabilidades publicadas para @graphql-tools/utils en los últimos 30 días: 2. Incluidas en el catálogo KEV: 0.

RSS ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 2

  1. CVE-2026-114604

    Sin evaluarCódigo de explotación públicoCorrección disponible

    GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

    ## Report metadata | Field | Value | | --- | --- | | Package | `@graphql-tools/utils` (npm, `pkg:github/ardatan/graphql-tools`) | | Repository | https://github.com/ardatan/graphql-tools | | Component | `mergeIncrementalResult` / `setObjectKeyPath` (`packages/utils/src/mergeIncrementalResult.ts`) | | Vulnerability class | Prototype pollution (via unvalidated object path traversal) | | Verified against | Source read at `134d67ae36a559651f43ec7fe4a9da76f4a00c2b`; `master` HEAD `ccca0ff0dc8ea20726fd116b2f19a38709c30e62`; published npm builds 10.10.0, 10.10.1, 11.0.0, 12.0.0, 12.0.1 | | Affected versions | `@graphql-tools/utils` >= 10.10.1 throug

    @graphql-tools/utilsNode.js
    • Actualiza a 12.0.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  2. CVE-2026-104852

    Alta · CVSS 8.2EPSS 0,36%Corrección disponible

    GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

    GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude __proto__, constructor, or prototype keys. An unauthenticated GraphQL client can alias fields to those names so responses from two subgraphs collide during ordinary supergraph result merging, causing mergeDeep to traverse Object and Function prototypes and overwrite Function.prototype.call with a subgraph-supplied value. This breaks subsequent requests in the process until restart. This issue is fix

    @graphql-tools/utilsNode.js
    • Actualiza a 12.0.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →