graphql-tools @graphql-tools/utils vulnerabilities

Latest graphql-tools @graphql-tools/utils CVEs

Newest publication first

1. CVE-2026-114604 GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

   Published 2026-11-05

   High·CVSS 8.4 EPSS 0.52%

   GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. From 10.10.1 until 12.0.2, the @graphql-tools/utils mergeIncrementalResult helper passes incrementalResult.path segments to setObjectKeyPath without runtime primitive-type validation. A non-pri...

2. CVE-2026-104852 GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

   Published 2026-10-05

   High·CVSS 8.2 EPSS 0.45%

   GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude proto, constructor, or prototype...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.