VIR Vulnerability Intelligence Relay

CVE-2026-32621

critical
Published 2026-03-16 · Modified 2026-03-19
CVSS v3
9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
CVSS v2
—
VIR risk
9.9

Description

Apollo Federation vulnerable to prototype pollution via incomplete key sanitization

Predictions

Exploit likelihood
98%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

Package impact
EcosystemPackageVulnerableFixed
npm npm@apollo/federation-internals<2.9.62.9.6
npm npm@apollo/federation-internals>=2.10.0,<2.10.52.10.5
npm npm@apollo/federation-internals>=2.11.0,<2.11.62.11.6
npm npm@apollo/federation-internals>=2.12.0,<2.12.32.12.3
npm npm@apollo/federation-internals>=2.13.0,<2.13.22.13.2
npm npm@apollo/gateway<2.9.62.9.6
npm npm@apollo/gateway>=2.10.0,<2.10.52.10.5
npm npm@apollo/gateway>=2.11.0,<2.11.62.11.6
npm npm@apollo/gateway>=2.12.0,<2.12.32.12.3
npm npm@apollo/gateway>=2.13.0,<2.13.22.13.2
npm npm@apollo/query-planner<2.9.62.9.6
npm npm@apollo/query-planner>=2.10.0,<2.10.52.10.5
npm npm@apollo/query-planner>=2.11.0,<2.11.62.11.6
npm npm@apollo/query-planner>=2.12.0,<2.12.32.12.3
npm npm@apollo/query-planner>=2.13.0,<2.13.22.13.2

References

CWEs

CWE-1321

Verify integrity in audit chain (admin only). AS-IS.