GitHub Advisoryadvisory · npm

GHSA-74cr-77xc-8g6r Prototype Pollution in @apollo/gateway

HIGH Published 2019-06-13 Modified 2021-08-16 Official page ↗
Ecosystem
npm
Packages
@apollo/gateway
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-1321, CWE-400
Reviewed
2019-06-13

Affected packages

• npm @apollo/gateway: < 0.6.2 → fixed in 0.6.2

Description

Versions of `@apollo/gateway` prior to 0.6.2 are vulnerable to Prototype Pollution. The package uses deepMerge() to merge objects, which may allow attackers to alter the Object prototype through queries with GraphQL aliases. Carefully constructed payloads can override properties of all objects in the application. This may lead to Denial of Service or may be chained with other vulnerabilities leading to Remote Code Execution. Recommendation Upgrade to version 0.6.2 or later.

Related

Weakness · CWE (2)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References