Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@graphql-mesh/runtime

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.1npmAmendedPublished

    Cache variables with the operations when transforms exist on the root level even if variables change in the further requests with the same operation

    CVE-2025-27097 · GHSA-rr4x-crhf-8886

    Affected
    • npm @graphql-mesh/runtime >= 0.96.5, < 0.96.9
    Fixed in
    0.96.9· Vendor fix available
    Issue
    When you have transforms on the root level or single source with transforms, and the client sends the same query with different variables, the initial variables are used in all following requests until the cache evicts DocumentNode. Let's say if a token is sent via variables, the following requests will act like the same token is sent even if the following requests have different tokens. This can cause a short memory leak but it won't grow per each request but per different operation until the cache evicts DocumentNode by LRU mechanism.

    Recommended action: Upgrade to 0.96.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →