p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de @graphql-tools/utils

Vulnérabilités publiées pour @graphql-tools/utils au cours des 30 derniers jours : 2. Présentes dans le catalogue KEV : 0.

RSS ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 2

  1. CVE-2026-114604

    Non évaluéeCode d’exploitation publicCorrectif disponible

    GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

    ## Report metadata | Field | Value | | --- | --- | | Package | `@graphql-tools/utils` (npm, `pkg:github/ardatan/graphql-tools`) | | Repository | https://github.com/ardatan/graphql-tools | | Component | `mergeIncrementalResult` / `setObjectKeyPath` (`packages/utils/src/mergeIncrementalResult.ts`) | | Vulnerability class | Prototype pollution (via unvalidated object path traversal) | | Verified against | Source read at `134d67ae36a559651f43ec7fe4a9da76f4a00c2b`; `master` HEAD `ccca0ff0dc8ea20726fd116b2f19a38709c30e62`; published npm builds 10.10.0, 10.10.1, 11.0.0, 12.0.0, 12.0.1 | | Affected versions | `@graphql-tools/utils` >= 10.10.1 throug

    @graphql-tools/utilsNode.js
    • Mettez à jour vers 12.0.2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2026-104852

    Élevée · CVSS 8.2EPSS 0,36%Correctif disponible

    GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

    GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude __proto__, constructor, or prototype keys. An unauthenticated GraphQL client can alias fields to those names so responses from two subgraphs collide during ordinary supergraph result merging, causing mergeDeep to traverse Object and Function prototypes and overwrite Function.prototype.call with a subgraph-supplied value. This breaks subsequent requests in the process until restart. This issue is fix

    @graphql-tools/utilsNode.js
    • Mettez à jour vers 12.0.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →