Apollographql vulnerabilities

Products

• Router 11
• Apollo Router 6
• Federation 4
• Apollo Gateway 3
• Apollo Helms-charts Router 3
• Apollo-router 2

Newest

• apollographql apollo mcp server, apollo-mcp-server +1 more Missing Host Header Validation in Apollo MCP Server for Localhost Deployments CVE-2026-35577 6.8 MediumApril 9, 2026
• apollographql apollo server, apollo-server +1 more Apollo Server is vulnerable to denial of service with `startStandaloneServer` CVE-2026-23897 Fix available 7.5 HighFebruary 4, 2026
• apollographql federation @apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields CVE-2025-64530 Fix available 7.5 HighNovember 13, 2025
• apollographql router Apollo Router Core: Access Control Bypass on Polymorphic Types CVE-2025-64173 Fix available 7.5 HighNovember 6, 2025
• apollographql router Apollo Router Improperly Enforces Renamed Access Control Directives CVE-2025-64347 Fix available 7.5 HighNovember 6, 2025
• apollographql embeddable-explorer Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass CVE-2025-59845 Fix available 8.2 HighSeptember 26, 2025
• apollographql apollo-rs apollo-compiler Named Fragment Processing Vulnerability CVE-2025-31496 Fix available 7.5 HighApril 7, 2025
• apollographql apollo gateway, federation +1 more Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass CVE-2025-32031 Fix available 7.5 HighApril 7, 2025
• apollographql apollo gateway, federation +1 more Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion CVE-2025-32030 Fix available 7.5 HighApril 7, 2025
• apollographql router Apollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processing CVE-2025-32380 Fix available 7.5 HighApril 7, 2025
• apollographql router Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow CVE-2025-32033 Fix available 7.5 HighApril 7, 2025
• apollographql router Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion CVE-2025-32034 Fix available 7.5 HighApril 7, 2025
• apollographql router Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass CVE-2025-32032 Fix available 7.5 HighApril 7, 2025
• apollographql apollo gateway, apollo router, federation +3 more +5 more Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries CVE-2024-43414 Fix available 7.5 HighAugust 27, 2024
• apollographql apollo router, router, apollo-router +1 more +3 more Apollo Router Coprocessors may cause Denial-of-Service when handling request bodies CVE-2024-43783 Fix available 7.5 HighAugust 27, 2024
• apollographql apollo router, router +1 more Defect in query plan cache may cause incorrect operations to be executed in Apollo Router CVE-2024-32971 Fix available 9.1 CriticalMay 2, 2024
• apollographql apollo router, router +1 more Apollo Router's Compressed Payloads do not respect HTTP Payload Limits CVE-2024-28101 Fix available 7.5 HighMarch 6, 2024
• apollographql apollo-client-nextjs, apollo client +1 more XSS in @apollo/experimental-nextjs-app-support CVE-2024-23841 Fix available 8.2 HighJanuary 30, 2024
• apollographql apollo router, router, apollo helms-charts router +2 more Improper Check or Handling of Exceptional Conditions in apollo-router CVE-2023-45812 Fix available 7.5 HighOctober 18, 2023
• apollographql apollo router, router +1 more Unnamed "Subscription" operation results in Denial-of-Service in apollographql/router CVE-2023-41317 Fix available 7.5 HighSeptember 5, 2023