Read the docs
TI-2026-68299 Aliases CVE-2026-104852GHSA-7mx3-vvmw-hjmv

Prototype pollution in GraphQL Tools mergeDeep function

Priority LOW 36CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

GraphQL Tools (graphql-tools) before 12.0.1 and @graphql-tools/utils before 12.0.1 are affected. The mergeDeep function follows inherited properties and does not exclude __proto__, constructor, or prototype keys, which is prototype pollution (CWE-1321). An unauthenticated GraphQL client can send crafted queries that make responses from two subgraphs collide, overwriting Function.prototype.call and breaking later requests until the process restarts.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Description from the CNA

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude __proto__, constructor, or prototype keys. An unauthenticated GraphQL client can alias fields to those names so responses from two subgraphs collide during ordinary supergraph result merging, causing mergeDeep to traverse Object and Function prototypes and overwrite Function.prototype.call with a subgraph-supplied value. This breaks subsequent requests in the process until restart. This issue is fixed in version 12.0.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00452 39th percentileScored 2026-11-07
Fix Partial graphql-tools (ardatan): 12.0.1@graphql-tools/utils (npm): 12.0.1Red Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ardatangraphql-toolsbefore 12.0.112.0.1Patch availableCNA
—@graphql-tools/utils (npm)before 12.0.112.0.1Patch availableGHSA-7mx3-vvmw-hjmv
  • graphql-tools Vendorardatan Affected before 12.0.1 Fixed in 12.0.1 Patch available CNA
  • @graphql-tools/utils (npm) Vendor— Affected before 12.0.1 Fixed in 12.0.1 Patch available GHSA-7mx3-vvmw-hjmv

Remediation

Upgrade @graphql-tools/utils to 12.0.1. The sources list no fixed version for graphql-tools. Red Hat fixes Red Hat OpenShift AI 3.5 in RHSA-2026:86891. Red Hat OpenShift Container Platform 4 and Self-service automation portal 2 are affected without a fix, and Red Hat has no plan available for them.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

  • Fix · CNA graphql-tools (ardatan) Fixed in 12.0.1
  • Fix · GHSA-7mx3-vvmw-hjmv @graphql-tools/utils (npm) Fixed in 12.0.1 Advisory →

Red Hat 1 advisory

  • RHSA-2026:86891 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 3.5.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9 +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Self-service automation portal 2AffectedNo fix yet
Red Hat OpenShift AI 3.5Fixed RHSA-2026:86891
Not affected: 4 products
  • Red Hat Developer Hub 1
  • Red Hat OpenShift AI 3.5
  • Red Hat OpenShift Container Platform 5
  • Self-service automation portal 2

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-104852
  2. 2026-10-06 Alias added: GHSA-7mx3-vvmw-hjmv
  3. 2026-10-06 Fix available: npm/@graphql-tools/[email protected] · GHSA-7mx3-vvmw-hjmv
  4. 2026-10-06 CVSS score added · GHSA-7mx3-vvmw-hjmv
  5. 2026-10-06 Weakness changed · GHSA-7mx3-vvmw-hjmv
  6. 2026-10-06 6 new references · GHSA-7mx3-vvmw-hjmv
  7. 2026-10-06 CISA SSVC decision points changed
  8. 2026-10-06 Priority changed: MEDIUM → LOW
  9. 2026-10-07 Affected versions changed · Red Hat
  10. 2026-10-07 CVSS score added · Red Hat
  11. 2026-10-08 Affected versions changed · Red Hat
  12. 2026-10-20 Affected versions changed · Red Hat
  13. 2026-10-21 Affected versions changed · Red Hat
  14. 2026-10-22 Fix available: RHSA-2026:86891 · Red Hat
  15. 2026-10-22 Fix available: Red Hat OpenShift AI 3.5 · Red Hat
  16. 2026-10-23 Affected versions changed · Red Hat
  17. 2026-10-27 Affected versions changed · Red Hat
  18. 2026-10-31 Affected versions changed · Red Hat

References

Other 6

  • TI-2026-82206 Stale connection parameters in GraphQL Tools WebSocket executor CVSS 4.0HIGH 8.2
  • TI-2026-82207 GraphQL Tools legacy WebSocket executor misroutes subscription data CVSS 4.0MEDIUM 6.0
  • TI-2026-85665 Prototype pollution in GraphQL Tools mergeIncrementalResult helper CVSS 4.0HIGH 8.4
  • TI-2026-65765 GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor CVSS 3.1HIGH 7.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences