Vulnerability · Published Feb 20, 2025 · Assigned by GitHub_M

CVE-2025-27097Cache variables with the operations when transforms exist on the root level even if variables change in the further requests with the same operation

Medium 5.1

In plain English

A medium-severity uncontrolled resource consumption in graphql-mesh from ardatan. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.4%top 62.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. When a user transforms on the root level or single source with transforms, and the client sends the same query with different variables, the initial variables are used in all following requests until the cache evicts DocumentNode. If a token is sent via variables, the following requests will act like the same token is sent even if the following requests have different tokens. This can cause a short memory leak but it won't grow per each request but per different operation until the cache evicts DocumentNode by LRU mechanism.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@graphql-mesh/runtime	0.96.9	GHSA-rr4x-crhf-8886

Affected products (as reported)

Vendor	Product	Versions
ardatan	graphql-mesh	@graphql-mesh/runtime: >= 0.96.9, < 0.96.9

Weakness: CWE-400 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

References

https://github.com/ardatan/graphql-mesh/security/advisories/GHSA-rr4x-crhf-8886 x_refsource_CONFIRM