apollographql/apollo-server Security Advisories | GitStock

medium2026-03-26

Apollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention

GHSA-9q82-xgwf-vj6h

high2026-02-04

Apollo Serve vulnerable to Denial of Service with `startStandaloneServer`

GHSA-mp6q-xf9x-fwf7 · CVE-2026-23897

low2023-08-30

Prevent logging invalid header values

GHSA-j5g3-5c8r-7qfx

low2023-06-16

@apollo/server vulnerable to unsafe application of Content Security Policy via reused nonces

GHSA-68jh-rf6x-836f

medium2022-11-02

Batched HTTP requests may set incorrect `cache-control` response header

GHSA-8r69-3cvp-wxc3

medium2022-10-12

The graphql-upload library included in Apollo Server 2 is vulnerable to CSRF mutations

GHSA-2p3c-p3qw-69r4

medium2022-08-18

apollo-server-core vulnerable to URL-based XSS attack affecting IE11 on default landing page

GHSA-2fvv-qxrq-7jq6

high2021-11-08

Cross-site Scripting Vulnerability in GraphQL Playground (distributed by Apollo Server)

GHSA-qm7x-rc44-rrqw