CVE-2026-104852

HighCVSS 8.2

Published: 05/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

27th percentile - higher than 27% of all known CVEs

Summary

GraphQL Tools prior to 12.0.1, in the mergeDeep function of the utils package, does not exclude __proto__, constructor, or prototype keys while recursively merging source objects. An unauthenticated GraphQL client can alias fields to those names so responses from two subgraphs collide during ordinary supergraph result merging, causing mergeDeep to traverse Object and Function prototypes and overwrite Function.prototype.call with a subgraph-supplied value. This breaks subsequent requests in the process until restart.

Risk Assessment

An attacker can cause denial of service (DoS) by overwriting prototypes, requiring a process restart. This may also lead to unpredictable application behavior.

Recommendation

Update GraphQL Tools to version 12.0.1 or later, which includes the fix. Additionally, consider restricting GraphQL access to authorized clients.

Other vulnerabilities in GraphQL Tools

CVE-2026-103921High
Prior to version 1.1.35, GraphQL Tools' executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loader with SubscriptionProtocol.LEGACY_WS, can accept an attacker-controlled certificate.

Original NVD description (English source)

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude __proto__, constructor, or prototype keys. An unauthenticated GraphQL client can alias fields to those names so responses from two subgraphs collide during ordinary supergraph result merging, causing mergeDeep to traverse Object and Function prototypes and overwrite Function.prototype.call with a subgraph-supplied value. This breaks subsequent requests in the process until restart. This issue is fixed in version 12.0.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS