Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
apollographql/apollo-server
main @ cfbfe71
49
Fixes
0
CVEs
HIGH
Peak severity
63.6%
Coverage
Highlights
Denial of Service: 23 prior fixes. Scrutinize any change in this area.
packages/apollo-server-core/src/ApolloServer.ts: most-fixed (5 issues). Treat as high-risk during review.
11 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
CSRF: GraphQL execution endpoints are highly vulnerable to CSRF when executing state-modifying operations. Mitigation requires strict HTTP request checks (e.g., verifying custom headers, checking Content-Type, or requiring preflight) on incoming GET/POST operations.
Denial of Service: Unbounded in-memory caches (such as those used for tracking Persisted Queries) allow malicious actors to trigger memory exhaustion by sending an arbitrary volume of distinct queries. Safe operations require bounding caches using strict eviction algorithms (like LRU).
Auth Bypass: Schema updates combined with multi-tenant or gateway setups can allow queries to bypass validation if custom caches (like documentStore) do not segment/prefix their cache keys. This permits executing invalid or unauthorized fields on updated schemas.