CVSS 3.1
9.9 criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:LCVE-2026-32621
Critical (9.9). EPSS 0.5% chance of exploitation in the next 30 days. Fixed in @apollo/federation-internals 2.10.5, 2.11.6, 2.12.3.
Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2, a vulnerability exists in query plan execution within the gateway that may allow pollution of Object.prototype in certain scenarios. A malicious client may be able to pollute Object.prototype in gateway directly by crafting operations with field aliases and/or variable names that target prototype-inheritable properties. Alternatively, if a subgraph were to be compromised by a malicious actor, they may be able to pollute Object.prototype in gateway by crafting JSON response payloads that target prototype-inheritable properties. This vulnerability is fixed in 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-31)
- CWE
- CWE-1321
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-pfjj-6f4p-rvmh | npm | @apollo/federation-internals | <2.9.6 | 2.9.6 |
| GHSA-pfjj-6f4p-rvmh | npm | @apollo/federation-internals | >=2.10.0 <2.10.5 | 2.10.5 |
| GHSA-pfjj-6f4p-rvmh | npm | @apollo/federation-internals | >=2.11.0 <2.11.6 | 2.11.6 |
| GHSA-pfjj-6f4p-rvmh | npm | @apollo/federation-internals | >=2.12.0 <2.12.3 | 2.12.3 |
| GHSA-pfjj-6f4p-rvmh | npm | @apollo/federation-internals | >=2.13.0 <2.13.2 | 2.13.2 |
| GHSA-pfjj-6f4p-rvmh | npm | @apollo/gateway | <2.9.6 | 2.9.6 |
| GHSA-pfjj-6f4p-rvmh | npm | @apollo/gateway | >=2.10.0 <2.10.5 | 2.10.5 |
| GHSA-pfjj-6f4p-rvmh | npm | @apollo/gateway | >=2.11.0 <2.11.6 | 2.11.6 |
| GHSA-pfjj-6f4p-rvmh | npm | @apollo/gateway | >=2.12.0 <2.12.3 | 2.12.3 |
| GHSA-pfjj-6f4p-rvmh | npm | @apollo/gateway | >=2.13.0 <2.13.2 | 2.13.2 |
| GHSA-pfjj-6f4p-rvmh | npm | @apollo/query-planner | <2.9.6 | 2.9.6 |
| GHSA-pfjj-6f4p-rvmh | npm | @apollo/query-planner | >=2.10.0 <2.10.5 | 2.10.5 |
| GHSA-pfjj-6f4p-rvmh | npm | @apollo/query-planner | >=2.11.0 <2.11.6 | 2.11.6 |
| GHSA-pfjj-6f4p-rvmh | npm | @apollo/query-planner | >=2.12.0 <2.12.3 | 2.12.3 |
| GHSA-pfjj-6f4p-rvmh | npm | @apollo/query-planner | >=2.13.0 <2.13.2 | 2.13.2 |