TI-2025-22676 Aliases CVE-2025-31496 GHSA-7mpv-9xg6-5r79

apollo-compiler Named Fragment Processing Vulnerability

LOW 39CWE-770Published 2025-04-07 · Updated 2025-04-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

apollo-compiler is a query-based compiler for the GraphQL query language. Prior to 1.27.0, a vulnerability in Apollo Compiler allowed queries with deeply nested and reused named fragments to be prohibitively expensive to validate. Named fragments were being processed once per fragment spread in some cases during query validation, leading to exponential resource usage when deeply nested and reused fragments were involved. This could lead to excessive resource consumption and denial of service in applications. This vulnerability is fixed in 1.27.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00438 38th percentileScored 2026-11-07

Fix Fixed apollo-rs (apollographql): 1.27.0apollo-compiler (crates.io): 1.27.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
apollographql	apollo-rs	before 1.27.0	1.27.0	Patch available	CNA
—	apollo-compiler (crates.io)	before 1.27.0	1.27.0	Patch available	GHSA-7mpv-9xg6-5r79

apollo-rs Vendorapollographql Affected before 1.27.0 Fixed in 1.27.0 Patch available CNA
apollo-compiler (crates.io) Vendor— Affected before 1.27.0 Fixed in 1.27.0 Patch available GHSA-7mpv-9xg6-5r79

Remediation

Fix · CNA apollo-rs (apollographql) Fixed in 1.27.0
Fix · GHSA-7mpv-9xg6-5r79 apollo-compiler (crates.io) Fixed in 1.27.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-31496
2026-10-03 Alias added: GHSA-7mpv-9xg6-5r79

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-31496

Other 3

TI-2024-21837 Defect in query plan cache may cause incorrect operations to be executed in Apollo Router CVSS 3.1CRITICAL 9.1
TI-2024-29063 Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries CVSS 3.1HIGH 7.5
TI-2026-19253 Apollo Server is vulnerable to denial of service with `startStandaloneServer` CVSS 3.1HIGH 7.5
TI-2025-23158 Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion CVSS 3.1HIGH 7.5
TI-2025-23157 Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow CVSS 3.1HIGH 7.5
TI-2025-23156 Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass CVSS 3.1HIGH 7.5

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences