GHSA-hff2-gcpx-8f4p
NoneCVSS
—
EPSS
—
Published
Mar 26, 2026
CISA due date
—
The record
Apollo Router Core: Browser Bug Enables Bypass of XS-Search Prevention via Read-Only Cross-Site Request Forgery
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | apollo-router | 0 | 1.61.13 |
| crates.io | apollo-router | 2.0.0 | 2.10.2 |
| crates.io | apollo-router | 2.11.0 | 2.12.1 |
Related vulnerabilities
- CVE-2025-64347 Apollo Router Core is a configurable Rust graph router written to run a federated… Also affects apollo-router
- CVE-2025-64173 Apollo Router Core is a configurable graph router written in Rust to run a federated… Also affects apollo-router
- GHSA-x33c-7c2v-mrj9 Apollo Router Affected by an Access Control Bypass on Polymorphic Types Also affects apollo-router
- GHSA-g8jh-vg5j-4h3f Apollo Router Improperly Enforces Renamed Access Control Directives Also affects apollo-router
- CVE-2026-114657 Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows… CWE-200
- CVE-2026-114574 A security vulnerability has been detected in massCodeIO massCode 5.10. CWE-200
- CVE-2026-111756 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows… CWE-200
- CVE-2026-111755 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows… CWE-200