Uncontrolled resource consumption in ardatan graphql-mesh
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.
Summary
GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. When a user transforms on the root level or single source with transforms, and the client sends the same query with different variables, the initial variables are used in all following requests until the cache evicts DocumentNode. If a token is sent via variables, the following requests will act like the same token is sent even if the following requests have different tokens. This can cause a short memory leak but it won't grow per each request but per different operation until the cache evicts DocumentNode by LRU mechanism.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ardatan | graphql-mesh | @graphql-mesh/runtime: >= 0.96.9, < 0.96.9 | — | No fix listed | CNA |
| — | @graphql-mesh/runtime (npm) | 0.96.5 to before 0.96.9 | 0.96.9 | Patch available | GHSA-rr4x-crhf-8886 |
- graphql-mesh Vendorardatan Affected @graphql-mesh/runtime: >= 0.96.9, < 0.96.9 Fixed in — No fix listed CNA
- @graphql-mesh/runtime (npm) Vendor— Affected 0.96.5 to before 0.96.9 Fixed in 0.96.9 Patch available GHSA-rr4x-crhf-8886
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:the-guild:graphql_mesh:0.96.5:*:*:*:*:node.js:*:* | 0.96.5 | Vulnerable | The-guild |
| cpe:2.3:a:the-guild:graphql_mesh:0.96.6:*:*:*:*:node.js:*:* | 0.96.6 | Vulnerable | The-guild |
| cpe:2.3:a:the-guild:graphql_mesh:0.96.7:*:*:*:*:node.js:*:* | 0.96.7 | Vulnerable | The-guild |
| cpe:2.3:a:the-guild:graphql_mesh:0.96.8:*:*:*:*:node.js:*:* | 0.96.8 | Vulnerable | The-guild |
- cpe:2.3:a:the-guild:graphql_mesh:0.96.5:*:*:*:*:node.js:*:* Versions 0.96.5 Vulnerable ·The-guild
- cpe:2.3:a:the-guild:graphql_mesh:0.96.6:*:*:*:*:node.js:*:* Versions 0.96.6 Vulnerable ·The-guild
- cpe:2.3:a:the-guild:graphql_mesh:0.96.7:*:*:*:*:node.js:*:* Versions 0.96.7 Vulnerable ·The-guild
- cpe:2.3:a:the-guild:graphql_mesh:0.96.8:*:*:*:*:node.js:*:* Versions 0.96.8 Vulnerable ·The-guild
Remediation
- Fix · GHSA-rr4x-crhf-8886 @graphql-mesh/runtime (npm) Fixed in 0.96.9 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-27097
- 2026-10-03 Alias added: GHSA-rr4x-crhf-8886
References
Advisory 2
More ardatan vulnerabilities
- TI-2026-82206 Stale connection parameters in GraphQL Tools WebSocket executor CVSS 4.0HIGH 8.2
- TI-2026-82207 GraphQL Tools legacy WebSocket executor misroutes subscription data CVSS 4.0MEDIUM 6.0
- TI-2026-85665 Prototype pollution in GraphQL Tools mergeIncrementalResult helper CVSS 4.0HIGH 8.4
- TI-2026-68299 Prototype pollution in GraphQL Tools mergeDeep function CVSS 4.0HIGH 8.2
- TI-2026-65765 GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor CVSS 3.1HIGH 7.4
Sources
- CVE-2025-27097 · CVE Program
- CVE-2025-27097 · NVD
- FIRST EPSS
- GHSA-rr4x-crhf-8886 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences