GraphQL Tools: Prototype pollution in mergeDeep function
Summary
The mergeDeep function of the GraphQL Tools utils package (@graphql-tools/utils) up to version 12.0.0 does not block prototype keys such as __proto__, constructor or prototype when merging objects. An unauthenticated client can send crafted GraphQL field aliases that make responses from two subgraphs collide during supergraph merging, which can overwrite Function.prototype.call in the Node.js process. Subsequent requests then fail until the process is restarted, so the impact is mainly denial of service.
Affected
- @graphql-tools/utils up to and including 12.0.0 (prior to 12.0.1)
Fixed in
- @graphql-tools/utils 12.0.1 or later
Workaround
Unknown. The vendor provides no workaround; upgrading is the fix. Where direct upgrades are blocked, an npm overrides entry can force a patched version into transitive dependencies.
Exploitation
- No confirmed exploitation in the wild in the sources reviewed.
- CISA SSVC: exploitation none, not automatable, technical impact partial.
- Not listed in CISA KEV.
- EPSS below 1 percent.
Our recommendation
- Run npm ls @graphql-tools/utils and npm audit across all projects, including transitive dependencies.
- Upgrade to 12.0.1 or later; where a dependency pins an older range, use an npm overrides entry.
- Prioritise internet-facing GraphQL gateways and federated setups.
- Restart affected processes after patching and monitor for failing requests.
- Check whether the separate mergeIncrementalResult advisory also applies to your version.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-7mx3-vvmw-hjmv github.com
- Fix commit 0b9529f github.com
- Pull Request #8423 github.com
- Release @graphql-tools/utils 12.0.1 github.com
- GitLab Advisory Database entry advisories.gitlab.com
- OSV entry CVE-2026-104852 osv.dev
- Hive Gateway Pull Request #2600 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:02.
Original description (NVD)
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude __proto__, constructor, or prototype keys. An unauthenticated GraphQL client can alias fields to those names so responses from two subgraphs collide during ordinary supergraph result merging, causing mergeDeep to traverse Object and Function prototypes and overwrite Function.prototype.call with a subgraph-supplied value. This breaks subsequent requests in the process until restart. This issue is fixed in version 12.0.1.
NVD references (5)
- https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e
- https://github.com/ardatan/graphql-tools/pull/8423
- https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/utils@12.0.1
- https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv
- https://github.com/graphql-hive/gateway/pull/2600
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.