graphql-tools mergeIncrementalResult prototype pollution
Node.js programs using the GraphQL tools library can be tampered with.
Summary
The mergeIncrementalResult function in graphql-tools does not validate incremental response path segments, so a malicious or compromised upstream GraphQL response can write attacker-chosen properties to Object.prototype in the Node.js process. Versions from 10.10.1 until 12.0.2 are affected.
Affected when
- merging untrusted @defer or @stream transport results
What to do
Update to version 12.0.2 or later.
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab)
Times
First published
First seen