Apollo Federation has prototype pollution via incomplete key sanitization
Priority MEDIUM 44CWE-1321Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2, a vulnerability exists in query plan execution within the gateway that may allow pollution of Object.prototype in certain scenarios. A malicious client may be able to pollute Object.prototype in gateway directly by crafting operations with field aliases and/or variable names that target prototype-inheritable properties. Alternatively, if a subgraph were to be compromised by a malicious actor, they may be able to pollute Object.prototype in gateway by crafting JSON response payloads that target prototype-inheritable properties. This vulnerability is fixed in 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00543 45th percentileScored 2026-11-07
Fix Fixed federation-internals (@apollo): 2.13.2, 2.12.3, 2.11.6 +2gateway (@apollo): 2.13.2, 2.12.3, 2.11.6 +2+4 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| @apollo | federation-internals | 2.13.0-preview.0 to before 2.13.2; 2.12.0-preview.0 to before 2.12.3; 2.11.0-preview.0 to before 2.11.6; 2.10.0-alpha.0 to before 2.10.5; before 2.9.6 | 2.13.2, 2.12.3, 2.11.6, 2.10.5, 2.9.6 | Patch available | CNA |
| @apollo | gateway | 2.13.0-preview.0 to before 2.13.2; 2.12.0-preview.0 to before 2.12.3; 2.11.0-preview.0 to before 2.11.6; 2.10.0-alpha.0 to before 2.10.5; before 2.9.6 | 2.13.2, 2.12.3, 2.11.6, 2.10.5, 2.9.6 | Patch available | CNA |
| @apollo | query-planner | 2.13.0-preview.0 to before 2.13.2; 2.12.0-preview.0 to before 2.12.3; 2.11.0-preview.0 to before 2.11.6; 2.10.0-alpha.0 to before 2.10.5; before 2.9.6 | 2.13.2, 2.12.3, 2.11.6, 2.10.5, 2.9.6 | Patch available | CNA |
| — | @apollo/federation-internals (npm) | before 2.9.6 | 2.9.6 | Patch available | GHSA-pfjj-6f4p-rvmh |
| — | @apollo/federation-internals (npm) | 2.10.0 to before 2.10.5 | 2.10.5 | Patch available | GHSA-pfjj-6f4p-rvmh |
| — | @apollo/federation-internals (npm) | 2.11.0 to before 2.11.6 | 2.11.6 | Patch available | GHSA-pfjj-6f4p-rvmh |
| — | @apollo/federation-internals (npm) | 2.12.0 to before 2.12.3 | 2.12.3 | Patch available | GHSA-pfjj-6f4p-rvmh |
| — | @apollo/federation-internals (npm) | 2.13.0 to before 2.13.2 | 2.13.2 | Patch available | GHSA-pfjj-6f4p-rvmh |
| — | @apollo/gateway (npm) | before 2.9.6 | 2.9.6 | Patch available | GHSA-pfjj-6f4p-rvmh |
| — | @apollo/gateway (npm) | 2.10.0 to before 2.10.5 | 2.10.5 | Patch available | GHSA-pfjj-6f4p-rvmh |
| — | @apollo/gateway (npm) | 2.11.0 to before 2.11.6 | 2.11.6 | Patch available | GHSA-pfjj-6f4p-rvmh |
| — | @apollo/gateway (npm) | 2.12.0 to before 2.12.3 | 2.12.3 | Patch available | GHSA-pfjj-6f4p-rvmh |
| — | @apollo/gateway (npm) | 2.13.0 to before 2.13.2 | 2.13.2 | Patch available | GHSA-pfjj-6f4p-rvmh |
| — | @apollo/query-planner (npm) | before 2.9.6 | 2.9.6 | Patch available | GHSA-pfjj-6f4p-rvmh |
| — | @apollo/query-planner (npm) | 2.10.0 to before 2.10.5 | 2.10.5 | Patch available | GHSA-pfjj-6f4p-rvmh |
| — | @apollo/query-planner (npm) | 2.11.0 to before 2.11.6 | 2.11.6 | Patch available | GHSA-pfjj-6f4p-rvmh |
| — | @apollo/query-planner (npm) | 2.12.0 to before 2.12.3 | 2.12.3 | Patch available | GHSA-pfjj-6f4p-rvmh |
| — | @apollo/query-planner (npm) | 2.13.0 to before 2.13.2 | 2.13.2 | Patch available | GHSA-pfjj-6f4p-rvmh |
- federation-internals Vendor@apollo Affected 2.13.0-preview.0 to before 2.13.2; 2.12.0-preview.0 to before 2.12.3; 2.11.0-preview.0 to before 2.11.6; 2.10.0-alpha.0 to before 2.10.5; before 2.9.6 Fixed in 2.13.2, 2.12.3, 2.11.6, 2.10.5, 2.9.6 Patch available CNA
- gateway Vendor@apollo Affected 2.13.0-preview.0 to before 2.13.2; 2.12.0-preview.0 to before 2.12.3; 2.11.0-preview.0 to before 2.11.6; 2.10.0-alpha.0 to before 2.10.5; before 2.9.6 Fixed in 2.13.2, 2.12.3, 2.11.6, 2.10.5, 2.9.6 Patch available CNA
- query-planner Vendor@apollo Affected 2.13.0-preview.0 to before 2.13.2; 2.12.0-preview.0 to before 2.12.3; 2.11.0-preview.0 to before 2.11.6; 2.10.0-alpha.0 to before 2.10.5; before 2.9.6 Fixed in 2.13.2, 2.12.3, 2.11.6, 2.10.5, 2.9.6 Patch available CNA
- @apollo/federation-internals (npm) Vendor— Affected before 2.9.6 Fixed in 2.9.6 Patch available GHSA-pfjj-6f4p-rvmh
- @apollo/federation-internals (npm) Vendor— Affected 2.10.0 to before 2.10.5 Fixed in 2.10.5 Patch available GHSA-pfjj-6f4p-rvmh
- @apollo/federation-internals (npm) Vendor— Affected 2.11.0 to before 2.11.6 Fixed in 2.11.6 Patch available GHSA-pfjj-6f4p-rvmh
- @apollo/federation-internals (npm) Vendor— Affected 2.12.0 to before 2.12.3 Fixed in 2.12.3 Patch available GHSA-pfjj-6f4p-rvmh
- @apollo/federation-internals (npm) Vendor— Affected 2.13.0 to before 2.13.2 Fixed in 2.13.2 Patch available GHSA-pfjj-6f4p-rvmh
- @apollo/gateway (npm) Vendor— Affected before 2.9.6 Fixed in 2.9.6 Patch available GHSA-pfjj-6f4p-rvmh
- @apollo/gateway (npm) Vendor— Affected 2.10.0 to before 2.10.5 Fixed in 2.10.5 Patch available GHSA-pfjj-6f4p-rvmh
- @apollo/gateway (npm) Vendor— Affected 2.11.0 to before 2.11.6 Fixed in 2.11.6 Patch available GHSA-pfjj-6f4p-rvmh
- @apollo/gateway (npm) Vendor— Affected 2.12.0 to before 2.12.3 Fixed in 2.12.3 Patch available GHSA-pfjj-6f4p-rvmh
- @apollo/gateway (npm) Vendor— Affected 2.13.0 to before 2.13.2 Fixed in 2.13.2 Patch available GHSA-pfjj-6f4p-rvmh
- @apollo/query-planner (npm) Vendor— Affected before 2.9.6 Fixed in 2.9.6 Patch available GHSA-pfjj-6f4p-rvmh
- @apollo/query-planner (npm) Vendor— Affected 2.10.0 to before 2.10.5 Fixed in 2.10.5 Patch available GHSA-pfjj-6f4p-rvmh
- @apollo/query-planner (npm) Vendor— Affected 2.11.0 to before 2.11.6 Fixed in 2.11.6 Patch available GHSA-pfjj-6f4p-rvmh
- @apollo/query-planner (npm) Vendor— Affected 2.12.0 to before 2.12.3 Fixed in 2.12.3 Patch available GHSA-pfjj-6f4p-rvmh
- @apollo/query-planner (npm) Vendor— Affected 2.13.0 to before 2.13.2 Fixed in 2.13.2 Patch available GHSA-pfjj-6f4p-rvmh
Remediation
- Fix · CNA federation-internals (@apollo) Fixed in 2.13.2, 2.12.3, 2.11.6, 2.10.5, 2.9.6
- Fix · CNA gateway (@apollo) Fixed in 2.13.2, 2.12.3, 2.11.6, 2.10.5, 2.9.6
- Fix · CNA query-planner (@apollo) Fixed in 2.13.2, 2.12.3, 2.11.6, 2.10.5, 2.9.6
- Fix · GHSA-pfjj-6f4p-rvmh @apollo/federation-internals (npm) Fixed in 2.9.6 Advisory →
- Fix · GHSA-pfjj-6f4p-rvmh @apollo/federation-internals (npm) Fixed in 2.10.5 Advisory →
- Fix · GHSA-pfjj-6f4p-rvmh @apollo/federation-internals (npm) Fixed in 2.11.6 Advisory →
- Fix · GHSA-pfjj-6f4p-rvmh @apollo/federation-internals (npm) Fixed in 2.12.3 Advisory →
- Fix · GHSA-pfjj-6f4p-rvmh @apollo/federation-internals (npm) Fixed in 2.13.2 Advisory →
- Fix · GHSA-pfjj-6f4p-rvmh @apollo/gateway (npm) Fixed in 2.9.6 Advisory →
- Fix · GHSA-pfjj-6f4p-rvmh @apollo/gateway (npm) Fixed in 2.10.5 Advisory →
- Fix · GHSA-pfjj-6f4p-rvmh @apollo/gateway (npm) Fixed in 2.11.6 Advisory →
- Fix · GHSA-pfjj-6f4p-rvmh @apollo/gateway (npm) Fixed in 2.12.3 Advisory →
- Fix · GHSA-pfjj-6f4p-rvmh @apollo/gateway (npm) Fixed in 2.13.2 Advisory →
- Fix · GHSA-pfjj-6f4p-rvmh @apollo/query-planner (npm) Fixed in 2.9.6 Advisory →
- Fix · GHSA-pfjj-6f4p-rvmh @apollo/query-planner (npm) Fixed in 2.10.5 Advisory →
- Fix · GHSA-pfjj-6f4p-rvmh @apollo/query-planner (npm) Fixed in 2.11.6 Advisory →
- Fix · GHSA-pfjj-6f4p-rvmh @apollo/query-planner (npm) Fixed in 2.12.3 Advisory →
- Fix · GHSA-pfjj-6f4p-rvmh @apollo/query-planner (npm) Fixed in 2.13.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-32621
- 2026-10-03 Alias added: GHSA-pfjj-6f4p-rvmh
References
Sources
- CVE-2026-32621 · CVE Program
- CVE-2026-32621 · NVD
- FIRST EPSS
- GHSA-pfjj-6f4p-rvmh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences