Skip to content
OpenAdvisories

Package · npm

@apollo/composition

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.5
    GHSA-m8jr-fxqx-8xx6

    Apollo Federation has Improper Enforcement of Access Control on Transitive Fields

    # Summary A vulnerability in Apollo Federation's composition logic did not enforce that fields depending on protected data through `@requires` and/or `@fromContext` directives have the same access control requirements as the fields they reference. This allowe…

    @apollo/composition npm
  • High 7.5
    CVE-2025-64530

    @apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields

    Apollo Federation is an architecture for declaratively composing APIs into a unified graph. A vulnerability in versions of Apollo Federation's composition logic prior to 2.9.5, 2.10.4, 2.11.5, and 2.12.1 allowed some queries to Apollo Router to improperly byp…

    apollographql federation @apollo/composition npm