Cloudanix VulnDB

GHSA-pfjj-6f4p-rvmh

Critical · 9.9

CVSS

9.9

EPSS

—

Published

Mar 13, 2026

CISA due date

—

The record

Apollo Federation vulnerable to prototype pollution via incomplete key sanitization

Affected packages

Ecosystem Package Introduced Fixed
npm @apollo/federation-internals 0 2.9.6
npm @apollo/federation-internals 2.10.0 2.10.5
npm @apollo/federation-internals 2.11.0 2.11.6
npm @apollo/federation-internals 2.12.0 2.12.3
npm @apollo/federation-internals 2.13.0 2.13.2
npm @apollo/gateway 0 2.9.6
npm @apollo/gateway 2.10.0 2.10.5
npm @apollo/gateway 2.11.0 2.11.6
npm @apollo/gateway 2.12.0 2.12.3
npm @apollo/gateway 2.13.0 2.13.2
npm @apollo/query-planner 0 2.9.6
npm @apollo/query-planner 2.10.0 2.10.5
npm @apollo/query-planner 2.11.0 2.11.6
npm @apollo/query-planner 2.12.0 2.12.3
npm @apollo/query-planner 2.13.0 2.13.2

Related vulnerabilities