VIR Vulnerability Intelligence Relay

CVE-2026-32621

critical
Published 2026-03-16 · Modified 2026-03-19
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
CVSS v4 NEW
—
not yet in upstream
VIR risk
9.9

Description

Apollo Federation vulnerable to prototype pollution via incomplete key sanitization

Predictions

Exploit likelihood
98%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Package impact
EcosystemPackageVulnerableFixed
npm npm@apollo/federation-internals<2.9.62.9.6
npm npm@apollo/federation-internals>=2.10.0,<2.10.52.10.5
npm npm@apollo/federation-internals>=2.11.0,<2.11.62.11.6
npm npm@apollo/federation-internals>=2.12.0,<2.12.32.12.3
npm npm@apollo/federation-internals>=2.13.0,<2.13.22.13.2
npm npm@apollo/gateway<2.9.62.9.6
npm npm@apollo/gateway>=2.10.0,<2.10.52.10.5
npm npm@apollo/gateway>=2.11.0,<2.11.62.11.6
npm npm@apollo/gateway>=2.12.0,<2.12.32.12.3
npm npm@apollo/gateway>=2.13.0,<2.13.22.13.2
npm npm@apollo/query-planner<2.9.62.9.6
npm npm@apollo/query-planner>=2.10.0,<2.10.52.10.5
npm npm@apollo/query-planner>=2.11.0,<2.11.62.11.6
npm npm@apollo/query-planner>=2.12.0,<2.12.32.12.3
npm npm@apollo/query-planner>=2.13.0,<2.13.22.13.2

References

CWEs

CWE-1321

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.