CVE-2026-32621
CVE-2026-32621 · Apollo Federation has prototype pollution via incomplete key sanitization
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2, a vulnerability exists in query plan execution within the gateway that may allow pollution of Object.prototype in certain scenarios. A malicious client may be able to pollute Object.prototype in gateway directly by crafting operations with field aliases and/or variable names that target prototype-inheritable properties. Alternatively, if a subgraph were to be compromised by a malicious actor, they may be able to pollute Object.prototype in gateway by crafting JSON response payloads that target prototype-inheritable properties. This vulnerability is fixed in 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2.
CVSS 9.9 · Critical · EPSS 0.5% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
federation-internals
- Versions
- >= 2.13.0-preview.0, < 2.13.2: Affected
- >= 2.12.0-preview.0, < 2.12.3: Affected
- >= 2.11.0-preview.0, < 2.11.6: Affected
- >= 2.10.0-alpha.0, < 2.10.5: Affected
- < 2.9.6: Affected
No fix published
gateway
- Versions
- >= 2.13.0-preview.0, < 2.13.2: Affected
- >= 2.12.0-preview.0, < 2.12.3: Affected
- >= 2.11.0-preview.0, < 2.11.6: Affected
- >= 2.10.0-alpha.0, < 2.10.5: Affected
- < 2.9.6: Affected
No fix published
query-planner
- Versions
- >= 2.13.0-preview.0, < 2.13.2: Affected
- >= 2.12.0-preview.0, < 2.12.3: Affected
- >= 2.11.0-preview.0, < 2.11.6: Affected
- >= 2.10.0-alpha.0, < 2.10.5: Affected
- < 2.9.6: Affected
No fix published
@apollo/federation-internals npm
- Affected ranges
- SEMVER: < 2.9.6
Update to 2.9.6
@apollo/federation-internals npm
- Affected ranges
- SEMVER: ≥ 2.10.0, < 2.10.5
Update to 2.10.5
@apollo/federation-internals npm
- Affected ranges
- SEMVER: ≥ 2.11.0, < 2.11.6
Update to 2.11.6
@apollo/federation-internals npm
- Affected ranges
- SEMVER: ≥ 2.12.0, < 2.12.3
Update to 2.12.3
@apollo/federation-internals npm
- Affected ranges
- SEMVER: ≥ 2.13.0, < 2.13.2
Update to 2.13.2
@apollo/gateway npm
- Affected ranges
- SEMVER: < 2.9.6
Update to 2.9.6
@apollo/gateway npm
- Affected ranges
- SEMVER: ≥ 2.10.0, < 2.10.5
Update to 2.10.5
@apollo/gateway npm
- Affected ranges
- SEMVER: ≥ 2.11.0, < 2.11.6
Update to 2.11.6
@apollo/gateway npm
- Affected ranges
- SEMVER: ≥ 2.12.0, < 2.12.3
Update to 2.12.3
@apollo/gateway npm
- Affected ranges
- SEMVER: ≥ 2.13.0, < 2.13.2
Update to 2.13.2
@apollo/query-planner npm
- Affected ranges
- SEMVER: < 2.9.6
Update to 2.9.6
@apollo/query-planner npm
- Affected ranges
- SEMVER: ≥ 2.10.0, < 2.10.5
Update to 2.10.5
@apollo/query-planner npm
- Affected ranges
- SEMVER: ≥ 2.11.0, < 2.11.6
Update to 2.11.6
@apollo/query-planner npm
- Affected ranges
- SEMVER: ≥ 2.12.0, < 2.12.3
Update to 2.12.3
@apollo/query-planner npm
- Affected ranges
- SEMVER: ≥ 2.13.0, < 2.13.2
Update to 2.13.2