CVE-2026-32621 Apollo Federation has prototype pollution via incomplete key sanitization
A malicious client or compromised subgraph can pollute Object.prototype in the Apollo Federation gateway, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32621?
CVE-2026-32621 is a critical vulnerability in @apollo federation-internals, published on 13 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2, a vulnerability exists in query plan execution within the gateway that may allow pollution of Object.prototype in certain scenarios. A malicious client may be able to pollute Object.prototype in gateway directly by crafting operations with field aliases and/or variable names that target prototype-inheritable properties. Alternatively, if a subgraph were to be compromised by a malicious actor, they may be able to pollute Object.prototype in gateway by crafting JSON response payloads that target prototype-inheritable properties. This vulnerability is fixed in 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2.
Weakness: CWE-1321
Which versions are affected by CVE-2026-32621?
30 open source packages ship an affected version, including @apollo/federation-internals, @apollo/gateway and @apollo/query-planner.
| Package | Affected | Fixed in |
|---|---|---|
@apollo/federation-internals npm | All versions | 2.9.6 |
@apollo/federation-internals npm | All versions | 2.9.6 |
@apollo/federation-internals npm | From 2.10.0 | 2.10.5 |
@apollo/federation-internals npm | From 2.10.0 | 2.10.5 |
@apollo/federation-internals npm | From 2.11.0 | 2.11.6 |
@apollo/federation-internals npm | From 2.11.0 | 2.11.6 |
24 more packages
@apollo/federation-internals npm | From 2.12.0 | 2.12.3 |
@apollo/federation-internals npm | From 2.12.0 | 2.12.3 |
@apollo/federation-internals npm | From 2.13.0 | 2.13.2 |
@apollo/federation-internals npm | From 2.13.0 | 2.13.2 |
@apollo/gateway npm | All versions | 2.9.6 |
@apollo/gateway npm | All versions | 2.9.6 |
@apollo/gateway npm | From 2.10.0 | 2.10.5 |
@apollo/gateway npm | From 2.10.0 | 2.10.5 |
@apollo/gateway npm | From 2.11.0 | 2.11.6 |
@apollo/gateway npm | From 2.11.0 | 2.11.6 |
@apollo/gateway npm | From 2.12.0 | 2.12.3 |
@apollo/gateway npm | From 2.12.0 | 2.12.3 |
@apollo/gateway npm | From 2.13.0 | 2.13.2 |
@apollo/gateway npm | From 2.13.0 | 2.13.2 |
@apollo/query-planner npm | All versions | 2.9.6 |
@apollo/query-planner npm | All versions | 2.9.6 |
@apollo/query-planner npm | From 2.10.0 | 2.10.5 |
@apollo/query-planner npm | From 2.10.0 | 2.10.5 |
@apollo/query-planner npm | From 2.11.0 | 2.11.6 |
@apollo/query-planner npm | From 2.11.0 | 2.11.6 |
@apollo/query-planner npm | From 2.12.0 | 2.12.3 |
@apollo/query-planner npm | From 2.12.0 | 2.12.3 |
@apollo/query-planner npm | From 2.13.0 | 2.13.2 |
@apollo/query-planner npm | From 2.13.0 | 2.13.2 |
How do I fix CVE-2026-32621?
Upgrade @apollo/federation-internals to a fixed version for your release line: 2.9.6, 2.10.5, 2.11.6 or 2.12.3.
Is CVE-2026-32621 being exploited?
There is no known exploitation of CVE-2026-32621 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-pfjj-6f4p-rvmh, ROOT-APP-NPM-CVE-2026-32621.