{"affected":[{"product":"graphql-tools","source":"CNA: GitHub_M","vendor":"ardatan","versions":[{"status":"affected","version":">= 10.10.1, < 12.0.2"}]},{"ecosystem":"npm","packageName":"@graphql-tools/utils","product":"@graphql-tools/utils","source":"GitHub GHSA-c4qx-w738-7hr3","vendor":"","versions":[{"status":"affected","version":">=10.10.1 <=12.0.1","versionType":"GitHub advisory range"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"@graphql-tools/utils","product":"@graphql-tools/utils","source":"OSV GHSA-c4qx-w738-7hr3","vendor":"","versions":[{"events":[{"introduced":"10.10.1"},{"fixed":"12.0.2"}],"lessThan":"12.0.2","status":"affected","version":"10.10.1","versionType":"semver"}]}],"cveId":"CVE-2026-114604","cwes":["CWE-1321"],"description":"GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. From 10.10.1 until 12.0.2, the @graphql-tools/utils mergeIncrementalResult helper passes incrementalResult.path segments to setObjectKeyPath without runtime primitive-type validation. A non-primitive segment can bypass strict comparisons against __proto__, constructor, and prototype, then be coerced during property access so a malicious or compromised upstream incremental GraphQL response writes attacker-controlled properties to Object.prototype in the consuming Node.js process. The affected implementation is packages/utils/src/mergeIncrementalResult.ts and is reachable when consumers merge untrusted @defer or @stream transport results. This issue is fixed in version 12.0.2.","epss":{"date":"2026-11-09","percentile":0.44547,"score":0.00521},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/ardatan/graphql-tools/security/advisories/GHSA-c4qx-w738-7hr3"}],"kev":null,"metrics":[{"score":8.4,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},{"score":8.4,"severity":"high","source":"NVD: security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"}],"modifiedAt":1794249472147,"publishedAt":1793911059814,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/ardatan/graphql-tools/security/advisories/GHSA-c4qx-w738-7hr3"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/ardatan/graphql-tools/pull/8467"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/ardatan/graphql-tools/commit/19f5b3373fd7ace0688d19950fc529ce8347952a"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/ardatan/graphql-tools/commit/20d36a5c6eb8fd5524420988e01a48618c450d70"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/utils@12.0.2"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/ardatan/graphql-tools/security/advisories/GHSA-c4qx-w738-7hr3"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/ardatan/graphql-tools/commit/19f5b3373fd7ace0688d19950fc529ce8347952a"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/ardatan/graphql-tools/commit/20d36a5c6eb8fd5524420988e01a48618c450d70"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/ardatan/graphql-tools/pull/8467"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/utils@12.0.2"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/ardatan/graphql-tools/security/advisories/GHSA-c4qx-w738-7hr3"},{"source":"GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/ardatan/graphql-tools/security/advisories/GHSA-c4qx-w738-7hr3"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-c4qx-w738-7hr3"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-c4qx-w738-7hr3"}],"remediation":[{"kind":"fix","source":"GitHub GHSA-c4qx-w738-7hr3","text":"@graphql-tools/utils (npm): GitHub reports patched versions >=12.0.2. Check the advisory for the affected release branch.","url":"https://github.com/ardatan/graphql-tools/security/advisories/GHSA-c4qx-w738-7hr3"},{"kind":"fix","source":"OSV GHSA-c4qx-w738-7hr3","text":"@graphql-tools/utils (npm): OSV reports a fixed version 12.0.2. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-c4qx-w738-7hr3"}],"revision":"65989539a6d279ac6c0260181774a547398f65c81cc8af92bb7a1e69f675fc40","sources":[{"modifiedAt":1794249472147,"name":"CNA: GitHub_M","retrievedAt":1794251310608,"url":"https://www.cve.org/CVERecord?id=CVE-2026-114604"},{"modifiedAt":1793913517187,"name":"NVD","retrievedAt":1793946379064,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114604"},{"modifiedAt":1792684744000,"name":"GitHub Security Advisories","retrievedAt":1794087609546,"url":"https://github.com/ardatan/graphql-tools/security/advisories/GHSA-c4qx-w738-7hr3"},{"modifiedAt":1792687503723,"name":"OSV / GitHub Security Advisories","retrievedAt":1793913747509,"url":"https://osv.dev/vulnerability/GHSA-c4qx-w738-7hr3"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794251327959,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114604"}],"ssvc":{"assessedAt":1794249423413,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments","updatedAt":1794251327959}