Read the docs
TI-2025-23155 Aliases CVE-2025-32031GHSA-p2q6-pwh5-m6jr

Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass

Priority MEDIUM 40CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to 2.10.1, a vulnerability in Apollo Gateway allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically due to internal optimizations being frequently bypassed. The query planner includes an optimization that significantly speeds up planning for applicable GraphQL selections. However, queries with deeply nested and reused named fragments can generate many selections where this optimization does not apply, leading to significantly longer planning times. Because the query planner does not enforce a timeout, a small number of such queries can render gateway inoperable. This could lead to excessive resource consumption and denial of service. This has been remediated in @apollo/gateway version 2.10.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00603 49th percentileScored 2026-11-07
Fix Fixed federation (apollographql): 2.10.1@apollo/gateway (npm): 2.10.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
apollographqlfederationbefore 2.10.12.10.1Patch availableCNA
—@apollo/gateway (npm)before 2.10.12.10.1Patch availableGHSA-p2q6-pwh5-m6jr
  • federation Vendorapollographql Affected before 2.10.1 Fixed in 2.10.1 Patch available CNA
  • @apollo/gateway (npm) Vendor— Affected before 2.10.1 Fixed in 2.10.1 Patch available GHSA-p2q6-pwh5-m6jr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apollographql:apollo_gateway:*:*:*:*:*:node.js:*:*before 2.10.1Vulnerableapollographql
  • cpe:2.3:a:apollographql:apollo_gateway:*:*:*:*:*:node.js:*:* Versions before 2.10.1 Vulnerable ·apollographql

Remediation

  • Fix · CNA federation (apollographql) Fixed in 2.10.1
  • Fix · GHSA-p2q6-pwh5-m6jr @apollo/gateway (npm) Fixed in 2.10.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-32031
  2. 2026-10-03 Alias added: GHSA-p2q6-pwh5-m6jr

References

Patch 1

Advisory 2

Other 2

  • TI-2024-29063 Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries CVSS 3.1HIGH 7.5
  • TI-2025-23154 Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences