Skip to content
OpenAdvisories

Package · npm

@apollo/query-planner

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical 9.9
    CVE-2026-32621 Public exploit

    Apollo Federation has prototype pollution via incomplete key sanitization

    Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2, a vulnerability exists in query plan execution within the gateway that may allow pollution of Object.prototype in c…

    @apollo gateway federation-internals query-planner npm
  • High 7.5
    CVE-2024-43414

    Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries

    Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Each team can own their slice of the graph independently, empowering them to deliver autonomously and incrementally. Instances of @apollo/query-planner >=2.0.0 and <2.…

    apollographql federation apollo-router @apollo/gateway npm crates.io