VulnerableCode Package Details - pkg:npm/apollo-server@2.0.0

Vulnerabilities affecting this package (4)

Vulnerability	Summary	Fixed by
VCID-a82x-uben-ufdz Aliases: GHSA-qm7x-rc44-rrqw GMS-2021-33	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in apollo-server.	2.25.3 Affected by 0 other vulnerabilities. 3.4.1 Affected by 0 other vulnerabilities.
VCID-kq3g-ak44-kfge Aliases: GHSA-2p3c-p3qw-69r4 GMS-2022-5387	The graphql-upload library included in Apollo Server 2 is vulnerable to CSRF mutations ### Impact The [graphql-upload](https://www.npmjs.com/package/graphql-upload) npm package can execute GraphQL operations contained in `content-type: multipart/form-data` POST requests. Because they are POST requests, they can contain GraphQL mutations. Because they use `content-type: multipart/form-data`, they can be "simple requests" which are not preflighted by browsers. If your GraphQL server uses `graphql-upload` and uses `SameSite=None` cookies for authentication, then JS on any origin can cause browsers to send cookie-authenticated mutations to your GraphQL server, which will be executed without checking your CORS policy first. (The attack won't be able to see the response to the mutation if your CORS policy is set up properly, but the side effects of the mutation will still happen.) Additionally, if your GraphQL server uses `graphql-upload` and relies on network properties for security (whether by explicitly looking at the client's IP address or by only being available on a private network), then JS on any origin can cause browsers (which may be on a private network or have an allowed IP address) to send mutations to your GraphQL server, which will be executed without checking your CORS policy first. (This attack does not require your server to use cookies. It is in some cases prevented by some browsers such as Chrome.) Apollo Server 2 bundled `graphql-upload` and enabled it by default, so by default, Apollo Server 2 servers are vulnerable to these CSRF attacks. (Apollo Server 1 did not bundle `graphql-upload`. Apollo Server 3 no longer bundles `graphql-upload`, although AS3's docs do document how to manually integrate with `graphql-upload`.) It is enabled even if your server makes no use of the upload functionality. If you are running Apollo Server 2 (older than v2.25.4) and do not specify `uploads: false` to `new ApolloServer`, then you are vulnerable to this CSRF mutation attack. We recently introduced an opt-in CSRF prevention feature in Apollo Server 3.7. This feature successfully protects against CSRF even if you have manually integrated your AS3.7 server with `graphql-upload`. However, this feature is not available for Apollo Server 2. ### Patches If you are using Apollo Server 2 and do not actually use uploads in your schema (ie, the `Upload` scalar is not used as the argument to any field or in any input object definition, and you do not specify `uploads` to `new ApolloServer`), then upgrading to Apollo Server 2.25.4 will automatically disable `graphql-upload` in your server. This will fix the CSRF mutation vulnerability. Upgrading to v2.25.4 does still leave your server vulnerable to non-mutation CSRF attacks such as timing attacks against query operations. To protect yourself against these potentially lower impact CSRF attack, we encourage upgrading to Apollo Server v3.7 and enabling CSRF prevention. See [the Apollo Server 3 migration guide](https://www.apollographql.com/docs/apollo-server/migration/) and the [CSRF prevention docs](https://www.apollographql.com/docs/apollo-server/security/cors/#preventing-cross-site-request-forgery-csrf) for details. If you are actively using the uploads feature with Apollo Server 2, then upgrading to v2.25.4 will not disable the feature and you will still be vulnerable. You should instead upgrade to v3.7 and enable the CSRF prevention feature. If you are manually integrating the `graphql-upload` package with any version of Apollo Server (or any Node GraphQL server) and need to continue using the feature, then you must enable some sort of CSRF prevention feature to fix this vulnerability. We recommend the CSRF prevention feature in Apollo Server 3.7. ### Workarounds Instead of upgrading your Apollo Server 2 server, you can specify `uploads: false` to `new ApolloServer` to disable the `graphql-upload` integration and protect against CSRF mutations. (Only do this if you do not actually use the uploads feature in your server!) This will still leave your server vulnerable to non-mutation CSRF attacks such as timing attacks against query operations; you need to upgrade to v3.7 and enable CSRF prevention to protect against these attacks. ### Related work - [PR adding a Security section to the GraphQL multipart request spec](https://github.com/jaydenseric/graphql-multipart-request-spec/pull/64)	2.25.4 Affected by 0 other vulnerabilities.
VCID-peh1-p69m-nyh7 Aliases: CVE-2026-23897 GHSA-mp6q-xf9x-fwf7	Apollo Serve vulnerable to Denial of Service with `startStandaloneServer` The default configuration of `startStandaloneServer` from `@apollo/server/standalone` is vulnerable to Denial of Service (DoS) attacks through specially crafted request bodies with exotic character set encodings. This issue does not affect users that use `@apollo/server` as a dependency for integration packages, like `@as integrations/express5` or `@as-integrations/next`, only direct usage of `startStandaloneServer`.	There are no reported fixed by versions.
VCID-u2b9-99j7-rkbk Aliases: GHSA-w42g-7vfc-xf37 GMS-2020-59 GMS-2020-60 GMS-2020-61 GMS-2020-62 GMS-2020-63 GMS-2020-64 GMS-2020-65 GMS-2020-66 GMS-2020-67 GMS-2020-68 GMS-2020-69 GMS-2020-70	Introspection in schema validation in Apollo Server If `subscriptions: false` is passed to the `ApolloServer` constructor options, there is no impact. If implementors were not expecting validation rules to be enforced on the WebSocket subscriptions transport and are unconcerned about introspection being enabled on the WebSocket subscriptions transport (or were not expecting that), then this advisory is not applicable. If `introspection: true` is passed to the `ApolloServer` constructor options, the impact is limited to user-provided validation rules (i.e., using `validationRules`) since there would be no expectation that introspection was disabled.	2.14.2 Affected by 0 other vulnerabilities.

Next non-vulnerable version	2.14.2
Latest non-vulnerable version	3.4.1
Risk	4.0

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-05T17:12:30.898139+00:00	GitLab Importer	Affected by	VCID-kq3g-ak44-kfge	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/apollo-server/GMS-2022-5387.yml	38.6.0
2026-06-04T20:31:31.680723+00:00	GitLab Importer	Affected by	VCID-u2b9-99j7-rkbk	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/apollo-server/GMS-2020-59.yml	38.6.0
2026-06-02T04:49:56.670529+00:00	GitLab Importer	Affected by	VCID-peh1-p69m-nyh7	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/apollo-server/CVE-2026-23897.yml	38.6.0
2026-06-02T04:40:22.166293+00:00	GitLab Importer	Affected by	VCID-a82x-uben-ufdz	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/apollo-server/GMS-2021-33.yml	38.6.0