apollographql

Products

Exploited and recent CVEs

• CVE-2026-35577 Medium 6.8 Missing Host Header Validation in Apollo MCP Server for Localhost Deployments 0.2%
• CVE-2026-23897 High 7.5 Apollo Server is vulnerable to denial of service with `startStandaloneServer` 0.7%
• CVE-2025-64530 High 7.5 @apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields 0.4%
• CVE-2025-64347 High 7.5 Apollo Router Improperly Enforces Renamed Access Control Directives 0.3%
• CVE-2025-64173 High 7.5 Apollo Router Core: Access Control Bypass on Polymorphic Types 0.3%
• CVE-2025-59845 High 8.2 Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass 0.2%
• CVE-2025-32380 High 7.5 Apollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processing 0.6%
• CVE-2025-32034 High 7.5 Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion 0.6%
• CVE-2025-32033 High 7.5 Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow 0.6%
• CVE-2025-32032 High 7.5 Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass 0.6%
• CVE-2025-32031 High 7.5 Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass 0.6%
• CVE-2025-32030 High 7.5 Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion 0.5%
• CVE-2025-31496 High 7.5 apollo-compiler Named Fragment Processing Vulnerability 0.4%
• CVE-2024-43414 High 7.5 Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries 1.0%
• CVE-2024-43783 High 7.5 Apollo Router Coprocessors may cause Denial-of-Service when handling request bodies 0.9%
• CVE-2024-32971 Critical 9.1 Defect in query plan cache may cause incorrect operations to be executed in Apollo Router 0.7%
• CVE-2024-28101 High 7.5 Apollo Router's Compressed Payloads do not respect HTTP Payload Limits 0.8%
• CVE-2024-23841 High 8.2 XSS in @apollo/experimental-nextjs-app-support 0.4%
• CVE-2023-45812 High 7.5 Improper Check or Handling of Exceptional Conditions in apollo-router 0.9%
• CVE-2023-41317 High 7.5 Unnamed "Subscription" operation results in Denial-of-Service in apollographql/router 0.8%