apollographql vulnerabilities

Products

• router 11
• apollo router 6
• federation 4
• apollo gateway 3
• apollo helms-charts router 3
• apollo-router 2
• apollo client 1
• apollo mcp server 1
• apollo query-planner 1
• apollo server 1
• apollo-client-nextjs 1
• apollo-mcp-server 1
• apollo-rs 1
• apollo-server 1
• embeddable-explorer 1

Latest apollographql CVEs

Newest publication first

1. CVE-2026-35577 Missing Host Header Validation in Apollo MCP Server for Localhost Deployments

   Published 2026-04-09

   High·CVSS 8.1 EPSS 0.19%

   Apollo MCP Server is a Model Context Protocol server that exposes GraphQL operations as MCP tools. Prior to version 1.7.0, the Apollo MCP Server did not validate the Host header on incoming HTTP requests when using StreamableHTTP transport. In configurations where an HTTP-based M...

2. CVE-2026-23897 Apollo Server is vulnerable to denial of service with `startStandaloneServer`

   Published 2026-02-04

   High·CVSS 7.5 EPSS 0.69%

   Apollo Server is an open-source, spec-compliant GraphQL server that's compatible with any GraphQL client, including Apollo Client. In versions from 2.0.0 to 3.13.0, 4.2.0 to before 4.13.0, and 5.0.0 to before 5.4.0, the default configuration of startStandaloneServer from @apollo/...

3. CVE-2025-64530 @apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields

   Published 2025-11-13

   High·CVSS 7.5 EPSS 0.41%

   Apollo Federation is an architecture for declaratively composing APIs into a unified graph. A vulnerability in versions of Apollo Federation's composition logic prior to 2.9.5, 2.10.4, 2.11.5, and 2.12.1 allowed some queries to Apollo Router to improperly bypass access controls o...

4. CVE-2025-64347 Apollo Router Improperly Enforces Renamed Access Control Directives

   Published 2025-11-07

   High·CVSS 7.5 EPSS 0.33%

   Apollo Router Core is a configurable Rust graph router written to run a federated supergraph using Apollo Federation 2. Versions 1.61.12-rc.0 and below and 2.8.1-rc.0 allow unauthorized access to protected data through schema elements with access control directives (@authenticate...

5. CVE-2025-64173 Apollo Router Core: Access Control Bypass on Polymorphic Types

   Published 2025-11-06

   High·CVSS 7.5 EPSS 0.34%

   Apollo Router Core is a configurable graph router written in Rust to run a federated supergraph using Apollo Federation 2. In versions 1.61.11 below, as well as 2.0.0-alpha.0 through 2.8.1-rc.0, a vulnerability allowed for unauthenticated queries to access data that required addi...

6. CVE-2025-59845 Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass

   Published 2025-09-26

   High·CVSS 8.2 EPSS 0.17%

   Apollo Studio Embeddable Explorer & Embeddable Sandbox are website embeddable software solutions from Apollo GraphQL. Prior to Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3, a cross-site request forgery (CSRF) vulnerability was identified. The vulnerability arise...

7. CVE-2025-32380 Apollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processing

   Published 2025-04-09

   High·CVSS 7.5 EPSS 0.58%

   The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. A vulnerability in Apollo Router's usage of Apollo Compiler allowed queries with deeply nested and reused named fragments to be pro...

8. CVE-2025-32034 Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion

   Published 2025-04-07

   High·CVSS 7.5 EPSS 0.56%

   The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Prior to 1.61.2 and 2.1.1, a vulnerability in Apollo Router allowed queries with deeply nested and reused named fragments to be pro...

9. CVE-2025-32033 Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow

   Published 2025-04-07

   High·CVSS 7.5 EPSS 0.60%

   The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Prior to 1.61.2 and 2.1.1, the operation limits plugin uses unsigned 32-bit integers to track limit counters (e.g. for a query's he...

10. CVE-2025-32032 Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass

    Published 2025-04-07

    High·CVSS 7.5 EPSS 0.60%

    The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. A vulnerability in Apollo Router allowed queries with deeply nested and reused named fragments to be prohibitively expensive to que...

11. CVE-2025-32031 Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass

    Published 2025-04-07

    High·CVSS 7.5 EPSS 0.60%

    Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to 2.10.1, a vulnerability in Apollo Gateway allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specificall...

12. CVE-2025-32030 Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion

    Published 2025-04-07

    High·CVSS 7.5 EPSS 0.53%

    Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to 2.10.1, a vulnerability in Apollo Gateway allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specificall...

13. CVE-2025-31496 apollo-compiler Named Fragment Processing Vulnerability

    Published 2025-04-07

    High·CVSS 7.5 EPSS 0.44%

    apollo-compiler is a query-based compiler for the GraphQL query language. Prior to 1.27.0, a vulnerability in Apollo Compiler allowed queries with deeply nested and reused named fragments to be prohibitively expensive to validate. Named fragments were being processed once per fra...

14. CVE-2024-43414 Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries

    Published 2024-08-27

    High·CVSS 7.5 EPSS 0.99%

    Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Each team can own their slice of the graph independently, empowering them to deliver autonomously and incrementally. Instances of @apollo/query-planner >=2.0.0 and <2.8.5 are impacted by a...

15. CVE-2024-43783 Apollo Router Coprocessors may cause Denial-of-Service when handling request bodies

    Published 2024-08-27

    High·CVSS 7.5 EPSS 0.86%

    The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Instances of the Apollo Router running versions >=1.21.0 and < 1.52.1 are impacted by a denial of service vulnerability if all of t...

16. CVE-2024-32971 Defect in query plan cache may cause incorrect operations to be executed in Apollo Router

    Published 2024-05-02

    Critical·CVSS 9.1 EPSS 0.73%

    Apollo Router is a configurable, graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. The affected versions of Apollo Router contain a bug that in limited circumstances, could lead to unexpected operations being executed which can result in un...

17. CVE-2024-28101 Apollo Router's Compressed Payloads do not respect HTTP Payload Limits

    Published 2024-03-06

    High·CVSS 7.5 EPSS 0.77%

    The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Denial-of-Service (DoS) type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluat...

18. CVE-2024-23841 XSS in @apollo/experimental-nextjs-app-support

    Published 2024-01-30

    Medium·CVSS 6.1 EPSS 0.39%

    apollo-client-nextjs is the Apollo Client support for the Next.js App Router. The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this vulnerability, an attacker would need to either inject malicious input (e...

19. CVE-2023-45812 Improper Check or Handling of Exceptional Conditions in apollo-router

    Published 2023-10-18

    High·CVSS 7.5 EPSS 0.87%

    The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-...

20. CVE-2023-41317 Unnamed "Subscription" operation results in Denial-of-Service in apollographql/router

    Published 2023-09-05

    Medium·CVSS 5.9 EPSS 0.80%

    The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when GraphQ...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.