Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact What kind of vulnerability is it? Apollo Server can log sensitive information (Studio API keys) if they are passed incorrectly (with leading/trailing whitespace) or if they have any characters that are invalid as part of a header value. Who is impacted? Users who (all of the below): use either the schema reporting or usage reporting feature use an Apollo Studio API key which has invalid header values use the default fetcher (node-fetch) or configured their own node-fetch fetcher The following node snippet can test whether your API key has invalid header values. This code is taken directly from node-fetch@2's header value validation code. If the provided API key is not a valid header value, whenever Apollo Server uses that API key in a request (to Studio, for example), node-fetch will throw an error which contains the header value. This error is logged in various ways depending on the user's configuration, but most likely the console or some configured logging service. Patches…
Recommended action: Upgrade to 3.12.1 or 2.26.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact In Apollo Server 3 and 4, the cache-control HTTP response header may not reflect the cache policy that should apply to an HTTP request when that HTTP request contains multiple operations using HTTP batching. This could lead to data being inappropriately cached and shared. Apollo Server allows clients to send multiple operations in a single HTTP request. The results of these operations are returned in a single HTTP response, with a single set of headers. Apollo Client Web and Apollo Kotlin both have opt-in features to use batched requests. Apollo Server has several features relating to caching. This advisory is about the ability to set the cache-control response header based on field- and operation-specific cache hints. (It is not about the "response cache plugin".) This header can be interpreted by a reverse proxy such as a CDN in front of your server, or by a browser. In Apollo Server 2, plugins such as the cache control plugin could not control the HTTP headers of responses…
Recommended action: Upgrade to 3.11.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The default landing page contained HTML to display a sample curl command which is made visible if the full landing page bundle could not be fetched from Apollo's CDN. The server's URL is directly interpolated into this command inside the browser from window.location.href. On some older browsers such as IE11, this value is not URI-encoded. On such browsers, opening a malicious URL pointing at an Apollo Router could cause execution of attacker-controlled JavaScript. This only affects Apollo Server with the default landing page enabled. Old browsers visiting your server may be affected if ANY of these apply: - You do not pass any landing page plugin to the plugins option of new ApolloServer. - You pass ApolloServerPluginLandingPageLocalDefault() or ApolloServerPluginLandingPageProductionDefault() to the plugins option of new ApolloServer. Browsers visiting your server are NOT affected if ANY of these apply: - You pass ApolloServerPluginLandingPageDisabled() to the plugins option…
Recommended action: Upgrade to 3.10.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
We encourage all users of Apollo Server to read this advisory in its entirety to understand the impact. The Resolution section contains details on patched versions. Impact If subscriptions: false is passed to the ApolloServer constructor options, there is no impact. If implementors were not expecting validation rules to be enforced on the WebSocket subscriptions transport and are unconcerned about introspection being enabled on the WebSocket subscriptions transport (or were not expecting that), then this advisory is not applicable. If introspection: true is passed to the ApolloServer constructor options, the impact is limited to user-provided validation rules (i.e., using validationRules) since there would be no expectation that introspection was disabled. The enforcement of user-provided validation rules on the HTTP transport is working as intended and is unaffected by this advisory. Similarly, disabling introspection on the HTTP transport is working as intended and is unaffected by…
Recommended action: Upgrade to 2.14.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.