apollographql vulnerabilities

CVEs per yearBy the year they were published

1. 20232
2. 20245
3. 202511
4. 20262

Newest CVEs

• CVE-2026-35577

  Missing Host Header Validation in Apollo MCP Server for Localhost Deployments

  apollographql · apollo-mcp-server

  Medium6.8
• CVE-2026-23897

  Apollo Server is vulnerable to denial of service with `startStandaloneServer`

  apollographql · apollo-server

  High7.5
• CVE-2025-64530

  @apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields

  apollographql · federation

  High7.5
• CVE-2025-64347

  Apollo Router Improperly Enforces Renamed Access Control Directives

  apollographql · router

  High7.5
• CVE-2025-64173

  Apollo Router Core: Access Control Bypass on Polymorphic Types

  apollographql · router

  High7.5
• CVE-2025-59845

  Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass

  apollographql · embeddable-explorer

  High8.2
• CVE-2025-32380

  Apollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processing

  apollographql · router

  High7.5
• CVE-2025-32034

  Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion

  apollographql · router

  High7.5
• CVE-2025-32033

  Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow

  apollographql · router

  High7.5
• CVE-2025-32032

  Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass

  apollographql · router

  High7.5