Skip to content
OpenAdvisories

Package · npm

@graphql-tools/utils

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.4
    CVE-2026-114604

    GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

    GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. From 10.10.1 until 12.0.2, the @graphql-tools/utils mergeIncrementalResult helper passes incrementalResult.path segments to setObjectKeyPath without runtime primitive-type …

    ardatan graphql-tools @graphql-tools/utils npm
  • High 8.2
    CVE-2026-104852

    GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

    GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude __proto__, …

    ardatan graphql-tools langfuse-3-worker @graphql-tools/utils Wolfi npm