Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-4vge-j91y-k3gg
Vulnerability ID VCID-4vge-j91y-k3gg
Aliases CVE-2026-23897
GHSA-mp6q-xf9x-fwf7
Summary Apollo Server is an open-source, spec-compliant GraphQL server that's compatible with any GraphQL client, including Apollo Client. In versions from 2.0.0 to 3.13.0, 4.2.0 to before 4.13.0, and 5.0.0 to before 5.4.0, the default configuration of startStandaloneServer from @apollo/server/standalone is vulnerable to denial of service (DoS) attacks through specially crafted request bodies with exotic character set encodings. This issue does not affect users that use @apollo/server as a dependency for integration packages, like @as-integrations/express5 or @as-integrations/next, only direct usage of startStandaloneServer.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1333 Inefficient Regular Expression Complexity
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2026-23897
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2026-23897
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-mp6q-xf9x-fwf7
cvssv3.1 7.5 https://github.com/apollographql/apollo-server
generic_textual HIGH https://github.com/apollographql/apollo-server
cvssv3.1 7.5 https://github.com/apollographql/apollo-server/commit/d25a5bdc377826ad424fcf7f8d1d062055911643
generic_textual HIGH https://github.com/apollographql/apollo-server/commit/d25a5bdc377826ad424fcf7f8d1d062055911643
ssvc Track https://github.com/apollographql/apollo-server/commit/d25a5bdc377826ad424fcf7f8d1d062055911643
cvssv3.1 7.5 https://github.com/apollographql/apollo-server/commit/e9d49d163a86b8a33be56ed27c494b9acd5400a4
generic_textual HIGH https://github.com/apollographql/apollo-server/commit/e9d49d163a86b8a33be56ed27c494b9acd5400a4
ssvc Track https://github.com/apollographql/apollo-server/commit/e9d49d163a86b8a33be56ed27c494b9acd5400a4
cvssv3.1 7.5 https://github.com/apollographql/apollo-server/security/advisories/GHSA-mp6q-xf9x-fwf7
cvssv3.1_qr HIGH https://github.com/apollographql/apollo-server/security/advisories/GHSA-mp6q-xf9x-fwf7
generic_textual HIGH https://github.com/apollographql/apollo-server/security/advisories/GHSA-mp6q-xf9x-fwf7
ssvc Track https://github.com/apollographql/apollo-server/security/advisories/GHSA-mp6q-xf9x-fwf7
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2026-23897
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-23897
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-23897
https://github.com/apollographql/apollo-server
CVE-2026-23897 https://nvd.nist.gov/vuln/detail/CVE-2026-23897
d25a5bdc377826ad424fcf7f8d1d062055911643 https://github.com/apollographql/apollo-server/commit/d25a5bdc377826ad424fcf7f8d1d062055911643
e9d49d163a86b8a33be56ed27c494b9acd5400a4 https://github.com/apollographql/apollo-server/commit/e9d49d163a86b8a33be56ed27c494b9acd5400a4
GHSA-mp6q-xf9x-fwf7 https://github.com/advisories/GHSA-mp6q-xf9x-fwf7
GHSA-mp6q-xf9x-fwf7 https://github.com/apollographql/apollo-server/security/advisories/GHSA-mp6q-xf9x-fwf7
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/apollographql/apollo-server
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/apollographql/apollo-server/commit/d25a5bdc377826ad424fcf7f8d1d062055911643
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-04T19:55:05Z/ Found at https://github.com/apollographql/apollo-server/commit/d25a5bdc377826ad424fcf7f8d1d062055911643
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/apollographql/apollo-server/commit/e9d49d163a86b8a33be56ed27c494b9acd5400a4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-04T19:55:05Z/ Found at https://github.com/apollographql/apollo-server/commit/e9d49d163a86b8a33be56ed27c494b9acd5400a4
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/apollographql/apollo-server/security/advisories/GHSA-mp6q-xf9x-fwf7
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-04T19:55:05Z/ Found at https://github.com/apollographql/apollo-server/security/advisories/GHSA-mp6q-xf9x-fwf7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2026-23897
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.17299
EPSS Score 0.00054
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:41:54.687115+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/23xxx/CVE-2026-23897.json 38.6.0