GraphQL Tools Vulnerability in @graphql-tools/utils by Ardatan
CVE-2026-114604

8.4HIGH

Key Information:

Vendor

Ardatan

Status
Graphql-tools
Vendor
CVE Published:
5 November 2026

What is CVE-2026-114604?

The @graphql-tools/utils package in versions 10.10.1 through 12.0.2 contains an improper validation vulnerability within the mergeIncrementalResult helper. This allows non-primitive segments of incrementalResult.path to bypass strict checks against prototype properties, potentially letting a compromised upstream GraphQL response write attacker-controlled properties directly to Object.prototype in the consuming Node.js context. This issue primarily arises when merging untrusted results from @defer or @stream transports. The issue has been addressed in version 12.0.2, making it essential for users to upgrade to mitigate potential risks.

Affected Version(s)

graphql-tools >= 10.10.1, < 12.0.2

References

https://github.com/ardatan/graphql-tools/security/advisor...
x_refsource_CONFIRM
https://github.com/ardatan/graphql-tools/pull/8467
x_refsource_MISC
https://github.com/ardatan/graphql-tools/commit/19f5b3373...
x_refsource_MISC

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.