GHSA-xf64-2f9p-6pqq
Information Exposure in type-graphql
Versions of type-graphql prior to 0.17.6 are vulnerable to Information Exposure. The package leaks the resolver source code in an error message. It is possible to force this error when no subscription topics are provided in the request.
Recommendation
Upgrade to version 0.17.6 or later.
What each source reports
GitHub AdvisoriesNo score
Information Exposure in type-graphql
Versions of type-graphql prior to 0.17.6 are vulnerable to Information Exposure. The package leaks the resolver source code in an error message. It is possible to force this error when no subscription topics are provided in the request.
Recommendation
Upgrade to version 0.17.6 or later.
- Record
GHSA-xf64-2f9p-6pqq- Weakness
- CWE-209
- Updated
- 2026-11-02
OSVNo score
Information Exposure in type-graphql
Versions of type-graphql prior to 0.17.6 are vulnerable to Information Exposure. The package leaks the resolver source code in an error message. It is possible to force this error when no subscription topics are provided in the request.
Recommendation
Upgrade to version 0.17.6 or later.
- Record
GHSA-xf64-2f9p-6pqq- Weakness
- CWE-209
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
type-graphqlnpm | before 0.17.6 | 0.17.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-xf64-2f9p-6pqq is a vulnerability with no CVSS score yet in type-graphql, published September 4, 2020. No source lists public exploit code. Fixed in type-graphql 0.17.6.