PT-2026-25379 · Npm+3 · @Apollo/Federation-Internals+9

R3Dbrothers · Publicado 2026-03-13 · Atualizado 2026-06-04 · CVE-2026-32621

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Apollo Federation versions prior to 2.9.6 Apollo Federation versions prior to 2.10.5 Apollo Federation versions prior to 2.11.6 Apollo Federation versions prior to 2.12.3 Apollo Federation versions prior to 2.13.2

Description Apollo Federation is an architecture for composing APIs into a unified graph. A flaw exists in query plan execution within the gateway that can allow pollution of Object.prototype in certain scenarios. A malicious client may be able to pollute Object.prototype directly by crafting operations with field aliases and/or variable names that target prototype-inheritable properties. Alternatively, if a subgraph is compromised, a malicious actor may be able to pollute Object.prototype by crafting JSON response payloads that target prototype-inheritable properties. Because Object.prototype is shared across the Node.js process, successful exploitation can affect subsequent requests to the gateway instance, potentially resulting in unexpected application behavior, privilege escalation, or data integrity issues. As of the date of this advisory, there are no reported exploitations of this issue.

Recommendations Upgrade to Apollo Federation version 2.9.6 or later. Upgrade to Apollo Federation version 2.10.5 or later. Upgrade to Apollo Federation version 2.11.6 or later. Upgrade to Apollo Federation version 2.12.3 or later. Upgrade to Apollo Federation version 2.13.2 or later.

Exploit

Correção

Prototype Pollution

Enumeração de Fraquezas

CWE-1321

Identificadores relacionados

CVE-2026-32621

GHSA-PFJJ-6F4P-RVMH

Produtos afetados

@Apollo/Federation-Internals

Apollo Gateway

@Apollo/Query-Planner

@Rootio/@Apollo/Gateway

@Rootio/Apollo Federation-Internals

@Rootio/Apollo Query-Planner

Federation

Federation-Internals

Gateway

Query-Planner

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32621.json · Exploit
• https://github.com/apollographql/federation/security/advisories/GHSA-pfjj-6f4p-rvmh · Nota
• https://github.com/apollographql/federation · Nota
• https://twitter.com/0dayPublishing/status/2032557055475650877 · Publicação no Twitter
• https://twitter.com/pulsepatchio/status/2035005429604905409 · Publicação no Twitter
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-32621 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-32621 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2032605867590193616 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2033569914770907301 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-pfjj-6f4p-rvmh · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32621 · Nota de Segurança