fix(deps): update dependency @apollo/gateway to v2.11.6 [security]#857
fix(deps): update dependency @apollo/gateway to v2.11.6 [security]#857renovate[bot] wants to merge 1 commit intomainfrom
Conversation
|
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #857 +/- ##
=======================================
Coverage 92.19% 92.19%
=======================================
Files 17 17
Lines 397 397
Branches 137 128 -9
=======================================
Hits 366 366
Misses 31 31 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
1 participant
This PR contains the following updates:
2.11.0→2.11.6GitHub Vulnerability Alerts
CVE-2026-32621
Impact
A vulnerability exists in query plan execution within the gateway that may allow pollution of
Object.prototypein certain scenarios. A malicious client may be able to polluteObject.prototypein gateway directly by crafting operations with field aliases and/or variable names that target prototype-inheritable properties. Alternatively, if a subgraph were to be compromised by a malicious actor, they may be able to polluteObject.prototypein gateway by crafting JSON response payloads that target prototype-inheritable properties.Because
Object.prototypeis shared across the Node.js process, successful exploitation can affect subsequent requests to the gateway instance. This may result in unexpected application behavior, privilege escalation, data integrity issues, or other security impact depending on how polluted properties are subsequently consumed by the application or its dependencies. As of the date of this advisory, Apollo is not aware of any reported exploitation of this vulnerability.Patches
Mitigations addressing prototype pollution exposure have been applied in
@apollo/federation-internals,@apollo/gateway, and@apollo/query-plannerversions2.9.6,2.10.5,2.11.6,2.12.3, and2.13.2. Users are encouraged to upgrade to these versions or later at their earliest convenience.Workarounds
A fully effective workaround is not available without a code change. As an interim measure, users who are unable to upgrade immediately may consider placing an input validation layer in front of the gateway to filter operations containing GraphQL names matching known
Object.prototypepollution patterns (e.g.,__proto__,constructor,prototype). Users should also ensure that subgraphs in their federated graph originate from trusted sources.Release Notes
apollographql/federation (@apollo/gateway)
v2.11.6Compare Source
Patch Changes
Fixed several code paths that access response objects to prevent JavaScript prototype pollution and unintended access to the prototype chain. (#3398)
See the associated GitHub Advisories GHSA-pfjj-6f4p-rvmh for more information.
Updated dependencies [
73ae202f72a31b9f63e779c535d7ecb059ff908a]:v2.11.5Compare Source
Patch Changes
5ee4d966487e714ae6bc6445bf53d75ccbbaf6ae,e1c58611c3c996b4fff98a54e49f00549ff2115d,3e2d1fd315db54a089fedf131cfaa27792bdd049]:v2.11.4Compare Source
Patch Changes
d221ac04c3ee00a3c7a671d9d56e2cfa36943b49,7730c03e128be6754b9e40c086d5cb5c4685ac66,4bda3a498eba36e187dfd9ae673eca12d3f3502c,f3ab499eaf62b1a1c0f08b838d2cbde5accb303a,6adbf7e86927de969aedab665b6a3a8dbf3a6095,2a20dc38dfc40e0b618d5cc826f18a19ddb91aff]:v2.11.3Compare Source
Patch Changes
4faa114215200daf7ad7518be8e50071fcde783c,8c7a2cd655ad3060e9f5c3b106cfbdb59251701c]:v2.11.2Compare Source
Patch Changes
28c08bef6e691aefc6ed07c0e7057f9cd803b317,28c08bef6e691aefc6ed07c0e7057f9cd803b317]:v2.11.1Compare Source
Patch Changes
7799ad1717becf15fb0e82f89619f2ec8a24b4d4,b26794c5724ef23d1f0fd45a40aee3d301557489,51bed5be49d8e87adae59f568315c9e3488a91e0]:Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.