VulnerableCode Package Details - pkg:npm/apollo-server-core@3.4.0

Vulnerabilities affecting this package (4)

Vulnerability	Summary	Fixed by
VCID-98q9-kzcd-77h4 Aliases: GHSA-9q82-xgwf-vj6h	Apollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention # Impact In a Cross-Site Request Forgery attack, untrusted web content causes browsers to send authenticated requests to web servers which use cookies for authentication. While the web content is prevented from reading the request's response due to the Cross-Origin Request Sharing (CORS) protocol, an attacker may be able to cause side effects in the server ("CSRF" attack), or learn something about the response via timing analysis ("XS-Search" attack). Apollo Server has a built-in feature which prevents CSRF and XS-Search attacks: it refuses to process GraphQL requests that could possibly have been sent by a spec-compliant web browser without a protective "preflight" step. See [Apollo Server's docs](https://www.apollographql.com/docs/apollo-server/security/cors) for more details on CORS, CSRF attacks, and Apollo Server's CSRF prevention feature. This feature is fully effective against attacks carried out against users of spec-compliant browsers. Unfortunately, a major browser introduced a bug in 2025 which meant in certain cases, it failed to follow the CORS spec. The browser's maintainers have already committed to fixing the bug and making the browser spec-compliant again. Even with this bug, Apollo Server's CSRF prevention feature blocks "side effect" CSRF attacks: Apollo Server will still correctly refuse to execute _mutations_ in requests that were not preflighted. However, some specially crafted authenticated GraphQL _queries_ can be issued across origins without preflight in buggy versions of this browser, allowing for XS-Search attacks: an attacker can analyze response times to learn facts about the responses to requests such as whether fields return null or approximately how many list entries are returned from fields. GraphQL servers are only vulnerable if they rely on cookies (or HTTP Basic Auth) for authentication. ## Patches The vulnerability is patched in `@apollo/server` v5.5.0. This release contains a single change: GraphQL requests sent in HTTP `GET` requests which contain a `Content-Type` header naming a type other than `application/json` are rejected. (`GET` requests with no `Content-Type` are allowed.) This change prevents XS-Search attacks even in browsers which are non-compliant in ways similar to this browser. There are no known cases where GraphQL apps depend on the ability of clients to send non-empty `Content-Type` headers with GET requests other than `application/json`, so this change has not been made configurable; if this change breaks a use case, [file an issue](https://github.com/apollographql/apollo-server/issues) and more configurability can be added. Apollo is not currently providing a patch for previous major versions of Apollo Server, which are all [end-of-life](https://www.apollographql.com/docs/apollo-server/previous-versions). ### Workarounds If upgrading is not possible, this particular browser's bug can be mitigated by preventing any HTTP request with a `Content-Type` header containing `message/` from reaching Apollo Server (e.g. in a proxy or middleware). For example, when using Apollo Server's Express integration, something like this can be placed before attaching `expressMiddleware` to the `app`: ```js app.use((req, res, next) => { for (let i = 0; i < req.rawHeaders.length - 1; i += 2) { if ( req.rawHeaders[i].toLowerCase() === 'content-type' && req.rawHeaders[i + 1].includes('message/') ) { return res.status(415).json({ error: 'Content-Type not allowed' }); } } next(); }); ``` While the patch prevents a broader class of similar issues, the only known way to exploit this vulnerability is against a particular browser which currently plans to ship a fix in May 2026. If it is already past June 2026 and this vulnerability has not been addressed yet, it is likely that the system is not currently vulnerable. Upgrading to the latest version of Apollo Server is still recommended for the broader protection. ## Resources The browser bug causes a similar vulnerability in Apollo Router; see https://github.com/apollographql/router/security/advisories/GHSA-hff2-gcpx-8f4p	There are no reported fixed by versions.
VCID-fdyu-hkcu-7bhy Aliases: GHSA-j5g3-5c8r-7qfx GMS-2023-2117 GMS-2023-2129	Prevent logging invalid header values ## Impact ### What kind of vulnerability is it? Apollo Server can log sensitive information (Studio API keys) if they are passed incorrectly (with leading/trailing whitespace) or if they have any characters that are invalid as part of a header value. ### Who is impacted? Users who (all of the below): * use either the schema reporting or usage reporting feature * use an Apollo Studio API key which has invalid header values * use the default fetcher (`node-fetch`) or configured their own `node-fetch` fetcher The following node snippet can test whether your API key has invalid header values. This code is taken directly from `node-fetch@2`'s header value validation code. ```js const invalidHeaderCharRegex = /[^\t\x20-\x7e\x80-\xff]/; if (invalidHeaderCharRegex.test('<YOUR_API_KEY>')) { console.log('potentially affected'); } console.log('unaffected'); ``` If the provided API key is not a valid header value, whenever Apollo Server uses that API key in a request (to Studio, for example), `node-fetch` will throw an error _which contains the header value_. This error is logged in various ways depending on the user's configuration, but most likely the console or some configured logging service. ### Patches This problem is patched in the latest version of Apollo Server as soon as this advisory is published. ### Workarounds * Try retrieving a new API key from Studio. Note: this may not work if the invalid character is not part of the secret (it may be derived from identifiers like graph name, user name). * Override the `fetcher` * Disable schema reporting and/or usage reporting ### Solution * Apollo Server will now call `.trim()` on incoming API keys in order to eliminate leading/trailing whitespace and log a warning when it does so. * Apollo Server will now perform the same validation of API keys as `node-fetch@2` performs on header values on startup. Apollo Server will throw an error on startup (i.e., fail to start completely) and notify the user their API key is invalid along with the offending characters.	3.12.1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-g2g3-wsxs-1qac Aliases: GHSA-8r69-3cvp-wxc3 GMS-2022-6226 GMS-2022-6235	Batched HTTP requests may set incorrect `cache-control` response header ### Impact In Apollo Server 3 and 4, the `cache-control` HTTP response header may not reflect the cache policy that should apply to an HTTP request when that HTTP request contains multiple operations using HTTP batching. This could lead to data being inappropriately cached and shared. Apollo Server allows clients to send multiple operations in a single HTTP request. The results of these operations are returned in a single HTTP response, with a single set of headers. Apollo Client Web and Apollo Kotlin both have opt-in features to use batched requests. Apollo Server has several features relating to caching. This advisory is about the ability to set the `cache-control` response header based on field- and operation-specific cache hints. (It is not about the "response cache plugin".) This header can be interpreted by a reverse proxy such as a CDN in front of your server, or by a browser. In Apollo Server 2, plugins such as the cache control plugin could not control the HTTP headers of responses to batch requests. This meant that batch requests never got the `cache-control` response header. In Apollo Server 3 and 4, plugins can set HTTP response headers. But for batched requests, plugins essentially assemble a separate set of response headers in parallel for each operation, and then the header sets are merged together. If plugins set the same header on multiple operations, one value is chosen arbitrarily. This meant that if a client sent a batched HTTP request with two operations with different cache policies, Apollo Server 3 and 4 would return a `cache-control` header that only applies to one of the operations. If one operation is allowed to be cached and the other operation is not allowed to be cached, the full response including both results could still end up being cached in a CDN or other reverse proxy cache. Note that valid batched requests must be POST requests. (There's no defined format for sending batched requests over GET.) So in order for this incorrect `cache-control` header to have a harmful effect, a cache must allow caching POST requests. This means this bug is unlikely to cause incorrect caching in browser or mobile client caches, or in many reverse proxy/CDN caches. This issue could lead to cache poisoning attacks. For example, if a client app regularly sends an operation that should not be cached due to its dependency on session-specific information in the same HTTP request as an operation that can be cached in a shared cache, an attacker could send its own version of the request to the server and manage to get the response to its request stored in the shared cache; other users would then see the response specific to the attacker for the first operation rather than the response for their own session. That said, we expect that in a system where this cache poisoning attack is feasible, normal operation would also run into the issue and users may have already disabled one of the features in order for their system to function properly. ### Patches This issue is patched in Apollo Server v3.11.0 and v4.1.0. The issue resolved differently in the two versions. If you are using Apollo Server 3, upgrade the package you depend on (eg `apollo-server` or `apollo-server-express`) to v3.11.0. This will restore the Apollo Server 2 behavior where the cache control plugin never sets the `cache-control` HTTP response header on batched requests. (Other cache-related features, like the response cache plugin, still function.) If you are using Apollo Server 4, upgrade `@apollo/server` to v4.1.0. This upgrade makes the response HTTP header object seen by plugins shared among all plugins processing all operations on a request, and makes the cache control plugin merge `cache-control` header values across operations in a request. (Note that if you set the `cache-control` response header in your own plugin, Apollo Server v4.1.0's cache control plugin will not try to overwrite the value you set.) ### Workarounds As a workaround, you can disable either the HTTP batching feature or the `cache-control` header feature. To disable HTTP batching in Apollo Server 3 (v3.5.0 or newer), pass `allowBatchedHttpRequests: false` to `new ApolloServer`.This is the default behavior for Apollo Server 4; in AS4, just make sure you're not passing `allowBatchedHttpRequests: true`. (You cannot disable batching in versions of Apollo Server 3 older than v3.5.0.) To disable the `cache-control` header feature, add `ApolloServerPluginCacheControl({ calculateHttpHeaders: false })` to the `plugins` list in `new ApolloServer()`. ### For more information If you have any questions or comments about this advisory: * Open an issue in [the `apollo-server` repository](https://github.com/apollographql/apollo-server) * Email us at [security@apollographql.com](mailto:security@apollographql.com)	3.11.0 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-m486-e7fw-9yhb Aliases: GHSA-2fvv-qxrq-7jq6 GMS-2022-3687	apollo-server-core vulnerable to URL-based XSS attack affecting IE11 on default landing page ### Impact The default landing page contained HTML to display a sample `curl` command which is made visible if the full landing page bundle could not be fetched from Apollo's CDN. The server's URL is directly interpolated into this command inside the browser from `window.location.href`. On some older browsers such as IE11, this value is not URI-encoded. On such browsers, opening a malicious URL pointing at an Apollo Router could cause execution of attacker-controlled JavaScript. This only affects Apollo Server with the [default landing page](https://www.apollographql.com/docs/apollo-server/api/plugin/landing-pages/) enabled. Old browsers visiting your server may be affected if ANY of these apply: - You do not pass any landing page plugin to the `plugins` option of `new ApolloServer`. - You pass `ApolloServerPluginLandingPageLocalDefault()` or `ApolloServerPluginLandingPageProductionDefault()` to the `plugins` option of `new ApolloServer`. Browsers visiting your server are NOT affected if ANY of these apply: - You pass `ApolloServerPluginLandingPageDisabled()` to the `plugins` option of `new ApolloServer`. - You pass `ApolloServerPluginLandingPageGraphQLPlayground()` to the `plugins` option of `new ApolloServer`. - You pass a custom plugin implementing the `renderLandingPage` hook to the `plugins` option of `new ApolloServer`. This issue was introduced in v3.0.0 when the landing page feature was added. ### Patches To avoid this, the sample `curl` command has been removed in release 3.10.1. ### Workarounds Disabling the landing page removes the possibility of exploit: ```ts import { ApolloServerPluginLandingPageDisabled } from 'apollo-server-core'; new ApolloServer({ plugins: [ApolloServerPluginLandingPageDisabled()], // ... }); ``` ### See also A similar issue exists in the landing page of Apollo Router. See the corresponding [Apollo Router security advisory](https://github.com/apollographql/router/security/advisories/GHSA-p5q6-hhww-f999). ### For more information If you have any questions or comments about this advisory: * Open an issue in [the Apollo Server repository](https://github.com/apollographql/apollo-server/) * Email us at [security@apollographql.com](mailto:security@apollographql.com) ### Credits This issue was discovered by Adrian Denkiewicz of [Doyensec](https://doyensec.com/research.html).	3.10.1 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-06T07:35:45.715105+00:00	GitLab Importer	Affected by	VCID-98q9-kzcd-77h4	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/apollo-server-core/GHSA-9q82-xgwf-vj6h.yml	38.6.0
2026-06-06T04:04:31.883414+00:00	GitLab Importer	Affected by	VCID-fdyu-hkcu-7bhy	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/apollo-server-core/GMS-2023-2129.yml	38.6.0
2026-06-06T03:09:06.140563+00:00	GitLab Importer	Affected by	VCID-g2g3-wsxs-1qac	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/apollo-server-core/GMS-2022-6235.yml	38.6.0
2026-06-06T02:46:10.567750+00:00	GitLab Importer	Affected by	VCID-m486-e7fw-9yhb	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/apollo-server-core/GMS-2022-3687.yml	38.6.0