PT-2026-25379 · Npm+3 · @Apollo/Federation-Internals+7

R3Dbrothers · Published 2026-03-13 · Updated 2026-03-20 · CVE-2026-32621

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Apollo Federation versions prior to 2.9.6 Apollo Federation versions prior to 2.10.5 Apollo Federation versions prior to 2.11.6 Apollo Federation versions prior to 2.12.3 Apollo Federation versions prior to 2.13.2

Description Apollo Federation is an architecture for composing APIs into a unified graph. A flaw exists in query plan execution within the gateway that can allow pollution of Object.prototype in certain scenarios. A malicious client may be able to pollute Object.prototype directly by crafting operations with field aliases and/or variable names that target prototype-inheritable properties. Alternatively, if a subgraph is compromised, a malicious actor may be able to pollute Object.prototype by crafting JSON response payloads that target prototype-inheritable properties. Because Object.prototype is shared across the Node.js process, successful exploitation can affect subsequent requests to the gateway instance, potentially resulting in unexpected application behavior, privilege escalation, or data integrity issues. As of the date of this advisory, there are no reported exploitations of this issue.

Recommendations Upgrade to Apollo Federation version 2.9.6 or later. Upgrade to Apollo Federation version 2.10.5 or later. Upgrade to Apollo Federation version 2.11.6 or later. Upgrade to Apollo Federation version 2.12.3 or later. Upgrade to Apollo Federation version 2.13.2 or later.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-32621

GHSA-PFJJ-6F4P-RVMH

Affected Products

@Apollo/Federation-Internals

Apollo Gateway

@Apollo/Query-Planner

@Rootio/@Apollo/Gateway

Federation

Federation-Internals

Gateway

Query-Planner

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32621.json · Exploit
• https://osv.dev/vulnerability/GHSA-pfjj-6f4p-rvmh · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-32621 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32621 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32621 · Vendor Advisory
• https://github.com/apollographql/federation/security/advisories/GHSA-pfjj-6f4p-rvmh · Note
• https://github.com/apollographql/federation · Note
• https://twitter.com/CVEnew/status/2032605867590193616 · Twitter Post
• https://twitter.com/pulsepatchio/status/2035005429604905409 · Twitter Post
• https://twitter.com/CveFindCom/status/2033569914770907301 · Twitter Post
• https://twitter.com/0dayPublishing/status/2032557055475650877 · Twitter Post