Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-peh1-p69m-nyh7
Vulnerability ID VCID-peh1-p69m-nyh7
Aliases CVE-2026-23897
GHSA-mp6q-xf9x-fwf7
Summary Apollo Serve vulnerable to Denial of Service with `startStandaloneServer` The default configuration of `startStandaloneServer` from `@apollo/server/standalone` is vulnerable to Denial of Service (DoS) attacks through specially crafted request bodies with exotic character set encodings. This issue does not affect users that use `@apollo/server` as a dependency for integration packages, like `@as integrations/express5` or `@as-integrations/next`, only direct usage of `startStandaloneServer`.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1333 Inefficient Regular Expression Complexity
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2026-23897
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-mp6q-xf9x-fwf7
cvssv3.1 7.5 https://github.com/apollographql/apollo-server
generic_textual HIGH https://github.com/apollographql/apollo-server
cvssv3.1 7.5 https://github.com/apollographql/apollo-server/commit/d25a5bdc377826ad424fcf7f8d1d062055911643
generic_textual HIGH https://github.com/apollographql/apollo-server/commit/d25a5bdc377826ad424fcf7f8d1d062055911643
ssvc Track https://github.com/apollographql/apollo-server/commit/d25a5bdc377826ad424fcf7f8d1d062055911643
cvssv3.1 7.5 https://github.com/apollographql/apollo-server/commit/e9d49d163a86b8a33be56ed27c494b9acd5400a4
generic_textual HIGH https://github.com/apollographql/apollo-server/commit/e9d49d163a86b8a33be56ed27c494b9acd5400a4
ssvc Track https://github.com/apollographql/apollo-server/commit/e9d49d163a86b8a33be56ed27c494b9acd5400a4
cvssv3.1 7.5 https://github.com/apollographql/apollo-server/security/advisories/GHSA-mp6q-xf9x-fwf7
cvssv3.1_qr HIGH https://github.com/apollographql/apollo-server/security/advisories/GHSA-mp6q-xf9x-fwf7
generic_textual HIGH https://github.com/apollographql/apollo-server/security/advisories/GHSA-mp6q-xf9x-fwf7
ssvc Track https://github.com/apollographql/apollo-server/security/advisories/GHSA-mp6q-xf9x-fwf7
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2026-23897
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-23897
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-23897
https://github.com/apollographql/apollo-server
https://github.com/apollographql/apollo-server/commit/d25a5bdc377826ad424fcf7f8d1d062055911643
https://github.com/apollographql/apollo-server/commit/e9d49d163a86b8a33be56ed27c494b9acd5400a4
CVE-2026-23897 https://nvd.nist.gov/vuln/detail/CVE-2026-23897
GHSA-mp6q-xf9x-fwf7 https://github.com/advisories/GHSA-mp6q-xf9x-fwf7
GHSA-mp6q-xf9x-fwf7 https://github.com/apollographql/apollo-server/security/advisories/GHSA-mp6q-xf9x-fwf7
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/apollographql/apollo-server
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/apollographql/apollo-server/commit/d25a5bdc377826ad424fcf7f8d1d062055911643
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-04T19:55:05Z/ Found at https://github.com/apollographql/apollo-server/commit/d25a5bdc377826ad424fcf7f8d1d062055911643
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/apollographql/apollo-server/commit/e9d49d163a86b8a33be56ed27c494b9acd5400a4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-04T19:55:05Z/ Found at https://github.com/apollographql/apollo-server/commit/e9d49d163a86b8a33be56ed27c494b9acd5400a4
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/apollographql/apollo-server/security/advisories/GHSA-mp6q-xf9x-fwf7
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-04T19:55:05Z/ Found at https://github.com/apollographql/apollo-server/security/advisories/GHSA-mp6q-xf9x-fwf7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2026-23897
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.06744
EPSS Score 0.00023
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:49:56.649661+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/apollo-server/CVE-2026-23897.yml 38.6.0