CVE-2026-104852

About vulnerability

Closed by https://github.com/ardatan/graphql-tools/pull/8423 Mitigated in Hive Gateway by https://github.com/graphql-hive/gateway/pull/2600

A client can alias fields to constructor, __proto__ or prototype so that the response keys from two subgraphs collide on those names during result merging. Because mergeDeep recursed through inherited properties, the merge walked {}.constructor to Object, then Object.__proto__ to Function.prototype, and wrote a subgraph-supplied value over Function.prototype.call, breaking every subsequent request in the process until restart. This is remotely triggerable by an unauthenticated client with a single query against any supergraph that merges an object from two subgraphs, which is the ordinary @shareable or entity case, so it is a denial of service rather than a theoretical hardening issue.

{
shared {
fieldA
constructor: fieldB {
__proto__: child {
call: value
}
}
}
}

Affected product:

@graphql-cli/common , apollo-client-graphql-codegen , apollo-gateway , apollo-server , apollo-server-azure-functions , apollo-server-cloud-functions , apollo-server-cloudflare , apollo-server-core , apollo-server-express , apollo-server-fastify , apollo-server-hapi , apollo-server-integration-koa , apollo-server-koa , apollo-server-lambda , apollo-server-micro , aws-cdk , babel-plugin-remove-graphql-queries , cdk , copilotkit , copilotkit-a2ui-renderer , copilotkit-agentcore-runner , copilotkit-mcp-apps-renderer , copilotkit-react-native , copilotkit-react-textarea , copilotkit-react-ui , copilotkit-runtime , copilotkit-runtime-client-gql , copilotkit-shared , copilotkit-sqlite-runner , copilotkit-voice , copilotkit-vue , copilotkit-web-components , copilotkit-web-inspector , create-strapi , create-strapi-app , crystal , dotansimha-graphql-yoga , envelop , envelop-extended-validation , envelop-rate-limiter , envelop-response-cache-redis , eslint-plugin-graphql , executor , gateway , gatsby , gatsby-cli , gatsby-cypress , gatsby-interface , gatsby-plugin-compile-es6-packages , gatsby-plugin-emotion , gatsby-plugin-fathom , gatsby-plugin-feed , gatsby-plugin-google-gtag , gatsby-plugin-guess-js , gatsby-plugin-less , gatsby-plugin-manifest , gatsby-plugin-netlify , gatsby-plugin-no-sourcemaps , gatsby-plugin-offline , gatsby-plugin-page-creator , gatsby-plugin-postcss , gatsby-plugin-preact , gatsby-plugin-preload-fonts , gatsby-plugin-react-helmet , gatsby-plugin-schema-snapshot , gatsby-plugin-sharp , gatsby-plugin-sitemap , gatsby-plugin-styletron , gatsby-plugin-typography , gatsby-react-router-scroll , gatsby-remark-code-repls , gatsby-remark-embed-snippet , gatsby-remark-prismjs , gatsby-remark-responsive-iframe , gatsby-source-contentful , gatsby-source-drupal , gatsby-source-filesystem , gatsby-source-graphql , gatsby-source-shopify , gatsby-source-wordpress , gatsby-transformer-react-docgen , gatsby-transformer-remark , gatsby-transformer-sqip , gatsby-transformer-toml , grafast , grafserv , graphile-config , graphile-export , graphql-code-generator , graphql-code-generator-community , graphql-codegen-add , graphql-codegen-c-sharp , graphql-codegen-client-preset , graphql-codegen-core , graphql-codegen-gql-tag-operations , graphql-codegen-plugin-helpers , graphql-codegen-schema-ast , graphql-codegen-testing , graphql-codegen-time , graphql-codegen-typed-document-node , graphql-codegen-typescript , graphql-codegen-typescript-document-nodes , graphql-codegen-typescript-generic-sdk , graphql-codegen-typescript-graphql-request , graphql-codegen-typescript-jit-sdk , graphql-codegen-typescript-msw , graphql-codegen-typescript-nhost , graphql-codegen-typescript-react-apollo , graphql-codegen-typescript-resolvers , graphql-codegen-typescript-rtk-query , graphql-config , graphql-hive-apollo , graphql-hive-cli , graphql-hive-envelop , graphql-hive-gateway , graphql-hive-gateway-plugin-console-sdk , graphql-hive-gateway-runtime , graphql-hive-gateway-testing , graphql-hive-logger-pino , graphql-hive-logger-winston , graphql-hive-plugin-aws-sigv4 , graphql-hive-plugin-mcp , graphql-hive-plugin-opentelemetry , graphql-hive-router-runtime , graphql-hive/console , graphql-hive/envelop , graphql-hive/platform , graphql-inspector , graphql-inspector-audit-command , graphql-inspector-cli , graphql-inspector-code-loader , graphql-inspector-commands , graphql-inspector-diff-command , graphql-inspector-docs-command , graphql-inspector-github-loader , graphql-inspector-introspect-command , graphql-inspector-json-loader , graphql-inspector-serve-command , graphql-inspector-similar-command , graphql-inspector-validate-command , graphql-language-service-server , graphql-live-queries , graphql-mesh , graphql-mesh-cache-cfw-kv , graphql-mesh-cache-file , graphql-mesh-cache-inmemory-lru , graphql-mesh-cache-localforage , graphql-mesh-cache-redis , graphql-mesh-cli , graphql-mesh-compose-cli , graphql-mesh-config , graphql-mesh-fusion-composition , graphql-mesh-fusion-runtime , graphql-mesh-graphql , graphql-mesh-grpc , graphql-mesh-hmac-upstream-signature , graphql-mesh-http , graphql-mesh-incontext-sdk-codegen , graphql-mesh-json-schema , graphql-mesh-merger-stitching , graphql-mesh-migrate-config-cli , graphql-mesh-mongoose , graphql-mesh-mysql , graphql-mesh-neo4j , graphql-mesh-odata , graphql-mesh-openapi , graphql-mesh-plugin-deduplicate-request , graphql-mesh-plugin-hive , graphql-mesh-plugin-http-cache , graphql-mesh-plugin-http-details-extensions , graphql-mesh-plugin-jit , graphql-mesh-plugin-live-query , graphql-mesh-plugin-mock , graphql-mesh-plugin-newrelic , graphql-mesh-plugin-opentelemetry , graphql-mesh-plugin-operation-field-permissions , graphql-mesh-plugin-operation-headers , graphql-mesh-plugin-prometheus , graphql-mesh-plugin-rate-limit , graphql-mesh-plugin-response-cache , graphql-mesh-plugin-snapshot , graphql-mesh-plugin-statsd , graphql-mesh-raml , graphql-mesh-runtime , graphql-mesh-store , graphql-mesh-supergraph , graphql-mesh-thrift , graphql-mesh-transform-cache , graphql-mesh-transform-encapsulate , graphql-mesh-transform-extend , graphql-mesh-transform-federation , graphql-mesh-transform-filter-schema , graphql-mesh-transform-hive , graphql-mesh-transform-hoist-field , graphql-mesh-transform-naming-convention , graphql-mesh-transform-prefix , graphql-mesh-transform-prune , graphql-mesh-transform-rate-limit , graphql-mesh-transform-rename , graphql-mesh-transform-replace-field , graphql-mesh-transform-resolvers-composition , graphql-mesh-transform-transfer-schema , graphql-mesh-transform-type-merging , graphql-mesh-transport-common , graphql-mesh-transport-grpc , graphql-mesh-transport-http , graphql-mesh-transport-http-callback , graphql-mesh-transport-mysql , graphql-mesh-transport-odata , graphql-mesh-transport-soap , graphql-mesh-transport-sqlite , graphql-mesh-transport-thrift , graphql-mesh-transport-ws , graphql-mesh-tuql , graphql-mesh-types , graphql-mesh-urql-exchange , graphql-mesh-utils , graphql-middleware , graphql-modules , graphql-rate-limit , graphql-shield , graphql-tools , graphql-tools-apollo-engine-loader , graphql-tools-batch-delegate , graphql-tools-batch-execute , graphql-tools-code-file-loader , graphql-tools-delegate , graphql-tools-executor , graphql-tools-executor-apollo-link , graphql-tools-executor-envelop , graphql-tools-executor-legacy-ws , graphql-tools-executor-urql-exchange , graphql-tools-executor-yoga , graphql-tools-git-loader , graphql-tools-github-loader , graphql-tools-graphql-file-loader , graphql-tools-graphql-tag-pluck , graphql-tools-import , graphql-tools-json-file-loader , graphql-tools-links , graphql-tools-load , graphql-tools-merge , graphql-tools-mock , graphql-tools-module-loader , graphql-tools-node-require , graphql-tools-relay-operation-optimizer , graphql-tools-resolvers-composition , graphql-tools-schema , graphql-tools-stitch , graphql-tools-url-loader , graphql-tools-utils , graphql-tools-wrap , graphql-yoga , graphql-yoga-apollo-link , graphql-yoga-apollo-managed-federation , graphql-yoga-graphiql , graphql-yoga-nestjs , graphql-yoga-nestjs-federation , graphql-yoga-plugin-apollo-inline-trace , graphql-yoga-plugin-apq , graphql-yoga-plugin-csrf-prevention , graphql-yoga-plugin-disable-introspection , graphql-yoga-plugin-graphql-sse , graphql-yoga-plugin-persisted-operations , graphql-yoga-plugin-sofa , graphql-yoga-render-apollo-sandbox , graphql-yoga-render-graphiql , logtape , logtape-adaptor-bunyan , logtape-adaptor-pino , logtape-adaptor-winston , logtape-cloudwatch-logs , logtape-config , logtape-drizzle-orm , logtape-elysia , logtape-express , logtape-fastify , logtape-file , logtape-graphql-yoga , logtape-hono , logtape-koa , logtape-lint , logtape-otel , logtape-pretty , logtape-redaction , logtape-sentry , logtape-syslog , logtape-testing , logtape-testing-bun , logtape-testing-node , logtape-testing-vitest , logtape-windows-eventlog , mdx , mockttp , neo4j-graphql , nestjs-apollo , nestjs-mercurius , nestjs/graphql , npm:gatsby-theme-blog-core , omnigraph-grpc , omnigraph-json-schema , omnigraph-mysql , omnigraph-neo4j , omnigraph-openapi , omnigraph-soap , omnigraph-thrift , pg-introspection , sentry-astro , sentry-deno , sentry-effect , sentry-elysia , sentry-ember , sentry-eslint-config-sdk , sentry-eslint-plugin-sdk , sentry-gatsby , sentry-google-cloud-serverless , sentry-hono , sentry-javascript , sentry-nitro , sentry-node-native , sentry-replay , sentry-server-runtime-injection , sentry-server-utils , sentry-solid , sentry-solidstart , sentry-tanstackstart , sentry-tanstackstart-react , sentry-wasm , sofa-api , strapi , strapi-admin , strapi-cloud-cli , strapi-content-manager , strapi-content-releases , strapi-content-type-builder , strapi-data-transfer , strapi-database , strapi-email , strapi-generators , strapi-i18n , strapi-logger , strapi-openapi , strapi-permissions , strapi-plugin-cloud , strapi-plugin-documentation , strapi-plugin-graphql , strapi-plugin-sentry , strapi-plugin-users-permissions , strapi-provider-email-mailgun , strapi-provider-email-sendgrid , strapi-provider-upload-aws-s3 , strapi-provider-upload-cloudinary , strapi-provider-upload-local , strapi-review-workflows , strapi-strapi , strapi-types , strapi-typescript-utils , strapi-upgrade , strapi-upload , strapi-utils , theme-ui

Affected packages:

@graphql-tools/utils @ 9.2.1 (+5142 more)