CVE-2026-32621

Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2, a vulnerability exists in query plan execution within the gateway that may allow pollution of Object.prototype in certain scenarios. A malicious client may be able to pollute Object.prototype in gateway directly by crafting operations with field aliases and/or variable names that target prototype-inheritable properties. Alternatively, if a subgraph were to be compromised by a malicious actor, they may be able to pollute Object.prototype in gateway by crafting JSON response payloads that target prototype-inheritable properties. This vulnerability is fixed in 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2.

Scoring

Severity

CRITICAL

CVSS base score

9.9

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

EPSS probability

0.51%

CWE

CWE-1321

Published

2026-03-13

Last modified

2026-03-16

Affected products

• @apollo federation-internals
• @apollo federation-internals
• @apollo federation-internals
• @apollo federation-internals
• @apollo federation-internals
• @apollo gateway
• @apollo gateway
• @apollo gateway

Weakness type

• CWE-1321

Related vulnerabilities

• CVE-2026-86078 — n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service
• CVE-2026-81994 — Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
• CVE-2026-85625 — sift 17.1.3 Prototype Pollution Remote Code Execution via $where
• CVE-2026-63376 — toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization
• CVE-2026-85063 — node-csv: Prototype replacement still reachable via columns path
• CVE-2026-82404 — TOON: Prototype pollution when decoding untrusted TOON input
• CVE-2026-84368 — joi: Prototype pollution via a `__proto__` language key in custom messages
• CVE-2026-84367 — joi: object().rename() with a template target can set the validated object's prototype

Markdown version · Browse all CVEs