CVE-2026-114604

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-114604
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-114604.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-114604
Aliases
Downstream
CGA (2)
openSUSE (1)
ROOT (1)
Related
Published
2026-11-05T20:37:39Z
Modified
2026-11-11T02:32:14Z
Severity
  • 8.4 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments
Details

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. From 10.10.1 until 12.0.2, the @graphql-tools/utils mergeIncrementalResult helper passes incrementalResult.path segments to setObjectKeyPath without runtime primitive-type validation. A non-primitive segment can bypass strict comparisons against proto, constructor, and prototype, then be coerced during property access so a malicious or compromised upstream incremental GraphQL response writes attacker-controlled properties to Object.prototype in the consuming Node.js process. The affected implementation is packages/utils/src/mergeIncrementalResult.ts and is reachable when consumers merge untrusted @defer or @stream transport results. This issue is fixed in version 12.0.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1321"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114604.json"
}
References

Affected packages

Git / github.com/ardatan/graphql-tools

Affected ranges

Type
GIT
Repo
https://github.com/ardatan/graphql-tools
Events
Introduced
5b26b6d00c21dd44efe6e7bb6042c4ddf3b3db5d
Fixed
3a43b4bb24e27c8f2d819d9fb571bf5b772e63b8
Fixed
19f5b3373fd7ace0688d19950fc529ce8347952a
Fixed
20d36a5c6eb8fd5524420988e01a48618c450d70
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "10.10.1"
                },
                {
                    "fixed": "12.0.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "19f5b3373fd7ace0688d19950fc529ce8347952a"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "20d36a5c6eb8fd5524420988e01a48618c450d70"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

@ardatan/relay-compiler@12.*
@ardatan/relay-compiler@12.3.0
@ardatan/relay-compiler@13.*
@ardatan/relay-compiler@13.0.0
@ardatan/relay-compiler@13.0.1
@ardatan/relay-compiler@13.0.2
@graphql-tools/apollo-engine-loader@8.*
@graphql-tools/apollo-engine-loader@8.0.24
@graphql-tools/apollo-engine-loader@8.0.25
@graphql-tools/apollo-engine-loader@8.0.26
@graphql-tools/apollo-engine-loader@8.0.27
@graphql-tools/apollo-engine-loader@8.0.28
@graphql-tools/apollo-engine-loader@8.0.29
@graphql-tools/apollo-engine-loader@8.0.30
@graphql-tools/apollo-engine-loader@8.0.31
@graphql-tools/apollo-engine-loader@8.0.32
@graphql-tools/apollo-engine-loader@8.0.33
@graphql-tools/apollo-engine-loader@8.0.34
@graphql-tools/apollo-engine-loader@8.0.35
@graphql-tools/apollo-engine-loader@8.0.36
@graphql-tools/code-file-loader@8.*
@graphql-tools/code-file-loader@8.1.24
@graphql-tools/code-file-loader@8.1.25
@graphql-tools/code-file-loader@8.1.26
@graphql-tools/code-file-loader@8.1.27
@graphql-tools/code-file-loader@8.1.28
@graphql-tools/code-file-loader@8.1.30
@graphql-tools/code-file-loader@8.1.31
@graphql-tools/code-file-loader@8.1.32
@graphql-tools/code-file-loader@8.1.33
@graphql-tools/code-file-loader@8.1.34
@graphql-tools/code-file-loader@8.1.35
@graphql-tools/code-file-loader@8.1.36
@graphql-tools/code-file-loader@8.1.37
@graphql-tools/code-file-loader@8.1.38
@graphql-tools/code-file-loader@8.1.39
@graphql-tools/documents@1.*
@graphql-tools/documents@1.0.2
@graphql-tools/executor-apollo-link@2.*
@graphql-tools/executor-apollo-link@2.0.10
@graphql-tools/executor-apollo-link@2.0.11
@graphql-tools/executor-apollo-link@2.0.12
@graphql-tools/executor-apollo-link@2.0.13
@graphql-tools/executor-apollo-link@2.0.14
@graphql-tools/executor-apollo-link@2.0.2
@graphql-tools/executor-apollo-link@2.0.3
@graphql-tools/executor-apollo-link@2.0.4
@graphql-tools/executor-apollo-link@2.0.5
@graphql-tools/executor-apollo-link@2.0.6
@graphql-tools/executor-apollo-link@2.0.7
@graphql-tools/executor-apollo-link@2.0.8
@graphql-tools/executor-apollo-link@2.0.9
@graphql-tools/executor-envelop@4.*
@graphql-tools/executor-envelop@4.0.10
@graphql-tools/executor-envelop@4.0.11
@graphql-tools/executor-envelop@4.0.12
@graphql-tools/executor-envelop@4.0.13
@graphql-tools/executor-envelop@4.0.14
@graphql-tools/executor-envelop@4.0.2
@graphql-tools/executor-envelop@4.0.3
@graphql-tools/executor-envelop@4.0.4
@graphql-tools/executor-envelop@4.0.5
@graphql-tools/executor-envelop@4.0.6
@graphql-tools/executor-envelop@4.0.7
@graphql-tools/executor-envelop@4.0.8
@graphql-tools/executor-envelop@4.0.9
@graphql-tools/executor-legacy-ws@1.*
@graphql-tools/executor-legacy-ws@1.1.21
@graphql-tools/executor-legacy-ws@1.1.22
@graphql-tools/executor-legacy-ws@1.1.23
@graphql-tools/executor-legacy-ws@1.1.24
@graphql-tools/executor-legacy-ws@1.1.25
@graphql-tools/executor-legacy-ws@1.1.26
@graphql-tools/executor-legacy-ws@1.1.27
@graphql-tools/executor-legacy-ws@1.1.28
@graphql-tools/executor-legacy-ws@1.1.29
@graphql-tools/executor-legacy-ws@1.1.30
@graphql-tools/executor-legacy-ws@1.1.31
@graphql-tools/executor-legacy-ws@1.1.32
@graphql-tools/executor-legacy-ws@1.1.33
@graphql-tools/executor-legacy-ws@1.1.34
@graphql-tools/executor-legacy-ws@1.1.35
@graphql-tools/executor-urql-exchange@1.*
@graphql-tools/executor-urql-exchange@1.0.24
@graphql-tools/executor-urql-exchange@1.0.25
@graphql-tools/executor-urql-exchange@1.0.26
@graphql-tools/executor-urql-exchange@1.0.27
@graphql-tools/executor-urql-exchange@1.0.28
@graphql-tools/executor-urql-exchange@1.0.29
@graphql-tools/executor-urql-exchange@1.0.30
@graphql-tools/executor-urql-exchange@1.0.31
@graphql-tools/executor-urql-exchange@1.0.32
@graphql-tools/executor-urql-exchange@1.0.33
@graphql-tools/executor-urql-exchange@1.0.34
@graphql-tools/executor-urql-exchange@1.0.35
@graphql-tools/executor-urql-exchange@1.0.36
@graphql-tools/executor-yoga@3.*
@graphql-tools/executor-yoga@3.0.32
@graphql-tools/executor-yoga@3.0.33
@graphql-tools/executor-yoga@3.0.34
@graphql-tools/executor-yoga@3.0.35
@graphql-tools/executor-yoga@3.0.36
@graphql-tools/executor-yoga@3.0.37
@graphql-tools/executor-yoga@3.0.38
@graphql-tools/executor-yoga@3.0.39
@graphql-tools/executor-yoga@3.0.40
@graphql-tools/executor-yoga@3.0.41
@graphql-tools/executor-yoga@3.0.42
@graphql-tools/executor-yoga@3.0.43
@graphql-tools/executor-yoga@3.0.44
@graphql-tools/executor@1.*
@graphql-tools/executor@1.4.11
@graphql-tools/executor@1.4.12
@graphql-tools/executor@1.4.13
@graphql-tools/executor@1.5.0
@graphql-tools/executor@1.5.1
@graphql-tools/executor@1.5.2
@graphql-tools/executor@1.5.3
@graphql-tools/executor@1.5.4
@graphql-tools/executor@1.5.5
@graphql-tools/executor@1.5.6
@graphql-tools/executor@1.5.7
@graphql-tools/executor@2.*
@graphql-tools/executor@2.0.0
@graphql-tools/executor@2.0.1
@graphql-tools/git-loader@8.*
@graphql-tools/git-loader@8.0.28
@graphql-tools/git-loader@8.0.29
@graphql-tools/git-loader@8.0.30
@graphql-tools/git-loader@8.0.31
@graphql-tools/git-loader@8.0.32
@graphql-tools/git-loader@8.0.34
@graphql-tools/git-loader@8.0.35
@graphql-tools/git-loader@8.0.36
@graphql-tools/git-loader@8.0.37
@graphql-tools/git-loader@8.0.38
@graphql-tools/git-loader@8.0.39
@graphql-tools/git-loader@8.0.40
@graphql-tools/git-loader@8.0.41
@graphql-tools/git-loader@8.0.42
@graphql-tools/github-loader@9.*
@graphql-tools/github-loader@9.0.2
@graphql-tools/github-loader@9.0.3
@graphql-tools/github-loader@9.0.4
@graphql-tools/github-loader@9.0.5
@graphql-tools/github-loader@9.0.6
@graphql-tools/github-loader@9.1.0
@graphql-tools/github-loader@9.1.1
@graphql-tools/github-loader@9.1.2
@graphql-tools/github-loader@9.1.3
@graphql-tools/github-loader@9.1.4
@graphql-tools/github-loader@9.1.5
@graphql-tools/github-loader@9.1.6
@graphql-tools/github-loader@9.1.7
@graphql-tools/github-loader@9.1.8
@graphql-tools/github-loader@9.1.9
@graphql-tools/graphql-file-loader@8.*
@graphql-tools/graphql-file-loader@8.1.11
@graphql-tools/graphql-file-loader@8.1.12
@graphql-tools/graphql-file-loader@8.1.13
@graphql-tools/graphql-file-loader@8.1.14
@graphql-tools/graphql-file-loader@8.1.15
@graphql-tools/graphql-file-loader@8.1.16
@graphql-tools/graphql-file-loader@8.1.17
@graphql-tools/graphql-file-loader@8.1.18
@graphql-tools/graphql-file-loader@8.1.19
@graphql-tools/graphql-file-loader@8.1.20
@graphql-tools/graphql-file-loader@8.1.4
@graphql-tools/graphql-file-loader@8.1.5
@graphql-tools/graphql-file-loader@8.1.6
@graphql-tools/graphql-file-loader@8.1.7
@graphql-tools/graphql-file-loader@8.1.8
@graphql-tools/graphql-file-loader@8.1.9
@graphql-tools/graphql-tag-pluck@8.*
@graphql-tools/graphql-tag-pluck@8.3.23
@graphql-tools/graphql-tag-pluck@8.3.24
@graphql-tools/graphql-tag-pluck@8.3.25
@graphql-tools/graphql-tag-pluck@8.3.26
@graphql-tools/graphql-tag-pluck@8.3.27
@graphql-tools/graphql-tag-pluck@8.3.29
@graphql-tools/graphql-tag-pluck@8.3.30
@graphql-tools/graphql-tag-pluck@8.3.31
@graphql-tools/graphql-tag-pluck@8.3.32
@graphql-tools/graphql-tag-pluck@8.3.33
@graphql-tools/graphql-tag-pluck@8.3.34
@graphql-tools/graphql-tag-pluck@8.3.35
@graphql-tools/graphql-tag-pluck@8.3.36
@graphql-tools/graphql-tag-pluck@8.3.37
@graphql-tools/import@7.*
@graphql-tools/import@7.1.11
@graphql-tools/import@7.1.12
@graphql-tools/import@7.1.13
@graphql-tools/import@7.1.14
@graphql-tools/import@7.1.15
@graphql-tools/import@7.1.16
@graphql-tools/import@7.1.17
@graphql-tools/import@7.1.18
@graphql-tools/import@7.1.19
@graphql-tools/import@7.1.4
@graphql-tools/import@7.1.5
@graphql-tools/import@7.1.6
@graphql-tools/import@7.1.7
@graphql-tools/import@7.1.8
@graphql-tools/import@7.1.9
@graphql-tools/import@7.2.0
@graphql-tools/jest-transform@2.*
@graphql-tools/jest-transform@2.0.2
@graphql-tools/json-file-loader@8.*
@graphql-tools/json-file-loader@8.0.22
@graphql-tools/json-file-loader@8.0.23
@graphql-tools/json-file-loader@8.0.24
@graphql-tools/json-file-loader@8.0.25
@graphql-tools/json-file-loader@8.0.26
@graphql-tools/json-file-loader@8.0.27
@graphql-tools/json-file-loader@8.0.28
@graphql-tools/json-file-loader@8.0.29
@graphql-tools/json-file-loader@8.0.30
@graphql-tools/json-file-loader@8.0.31
@graphql-tools/json-file-loader@8.0.32
@graphql-tools/json-file-loader@8.0.33
@graphql-tools/json-file-loader@8.0.34
@graphql-tools/links@10.*
@graphql-tools/links@10.0.10
@graphql-tools/links@10.0.11
@graphql-tools/links@10.0.12
@graphql-tools/links@10.0.13
@graphql-tools/links@10.0.14
@graphql-tools/links@10.0.2
@graphql-tools/links@10.0.3
@graphql-tools/links@10.0.4
@graphql-tools/links@10.0.5
@graphql-tools/links@10.0.6
@graphql-tools/links@10.0.7
@graphql-tools/links@10.0.8
@graphql-tools/links@10.0.9
@graphql-tools/load@8.*
@graphql-tools/load@8.1.10
@graphql-tools/load@8.1.11
@graphql-tools/load@8.1.12
@graphql-tools/load@8.1.13
@graphql-tools/load@8.1.14
@graphql-tools/load@8.1.15
@graphql-tools/load@8.1.16
@graphql-tools/load@8.1.17
@graphql-tools/load@8.1.4
@graphql-tools/load@8.1.5
@graphql-tools/load@8.1.6
@graphql-tools/load@8.1.7
@graphql-tools/load@8.1.8
@graphql-tools/load@8.1.9
@graphql-tools/merge@9.*
@graphql-tools/merge@9.1.10
@graphql-tools/merge@9.1.11
@graphql-tools/merge@9.1.3
@graphql-tools/merge@9.1.4
@graphql-tools/merge@9.1.5
@graphql-tools/merge@9.1.6
@graphql-tools/merge@9.1.7
@graphql-tools/merge@9.1.8
@graphql-tools/merge@9.1.9
@graphql-tools/merge@9.2.0
@graphql-tools/merge@9.2.1
@graphql-tools/merge@9.2.2
@graphql-tools/merge@9.2.3
@graphql-tools/merge@9.2.4
@graphql-tools/mock@9.*
@graphql-tools/mock@9.1.1
@graphql-tools/mock@9.1.10
@graphql-tools/mock@9.1.11
@graphql-tools/mock@9.1.12
@graphql-tools/mock@9.1.13
@graphql-tools/mock@9.1.14
@graphql-tools/mock@9.1.2
@graphql-tools/mock@9.1.3
@graphql-tools/mock@9.1.4
@graphql-tools/mock@9.1.5
@graphql-tools/mock@9.1.6
@graphql-tools/mock@9.1.7
@graphql-tools/mock@9.1.8
@graphql-tools/mock@9.1.9
@graphql-tools/module-loader@8.*
@graphql-tools/module-loader@8.0.22
@graphql-tools/module-loader@8.0.23
@graphql-tools/module-loader@8.0.24
@graphql-tools/module-loader@8.0.25
@graphql-tools/module-loader@8.0.26
@graphql-tools/module-loader@8.0.27
@graphql-tools/module-loader@8.0.28
@graphql-tools/module-loader@8.0.29
@graphql-tools/module-loader@8.0.30
@graphql-tools/module-loader@8.0.31
@graphql-tools/module-loader@8.0.32
@graphql-tools/module-loader@8.0.33
@graphql-tools/module-loader@8.0.34
@graphql-tools/node-require@7.*
@graphql-tools/node-require@7.0.29
@graphql-tools/node-require@7.0.30
@graphql-tools/node-require@7.0.31
@graphql-tools/node-require@7.0.32
@graphql-tools/node-require@7.0.33
@graphql-tools/node-require@7.0.34
@graphql-tools/node-require@7.0.36
@graphql-tools/node-require@7.0.37
@graphql-tools/node-require@7.0.38
@graphql-tools/node-require@7.0.39
@graphql-tools/node-require@7.0.40
@graphql-tools/node-require@7.0.41
@graphql-tools/node-require@7.0.42
@graphql-tools/node-require@7.0.43
@graphql-tools/node-require@7.0.44
@graphql-tools/node-require@7.0.45
@graphql-tools/node-require@7.0.46
@graphql-tools/optimize@2.*
@graphql-tools/optimize@2.0.1
@graphql-tools/relay-operation-optimizer@7.*
@graphql-tools/relay-operation-optimizer@7.0.23
@graphql-tools/relay-operation-optimizer@7.0.24
@graphql-tools/relay-operation-optimizer@7.0.25
@graphql-tools/relay-operation-optimizer@7.0.26
@graphql-tools/relay-operation-optimizer@7.0.27
@graphql-tools/relay-operation-optimizer@7.1.0
@graphql-tools/relay-operation-optimizer@7.1.1
@graphql-tools/relay-operation-optimizer@7.1.10
@graphql-tools/relay-operation-optimizer@7.1.2
@graphql-tools/relay-operation-optimizer@7.1.3
@graphql-tools/relay-operation-optimizer@7.1.4
@graphql-tools/relay-operation-optimizer@7.1.5
@graphql-tools/relay-operation-optimizer@7.1.6
@graphql-tools/relay-operation-optimizer@7.1.7
@graphql-tools/relay-operation-optimizer@7.1.8
@graphql-tools/relay-operation-optimizer@7.1.9
@graphql-tools/resolvers-composition@7.*
@graphql-tools/resolvers-composition@7.0.22
@graphql-tools/resolvers-composition@7.0.23
@graphql-tools/resolvers-composition@7.0.24
@graphql-tools/resolvers-composition@7.0.25
@graphql-tools/resolvers-composition@7.0.26
@graphql-tools/resolvers-composition@7.0.28
@graphql-tools/resolvers-composition@7.0.29
@graphql-tools/resolvers-composition@7.0.30
@graphql-tools/resolvers-composition@7.0.31
@graphql-tools/resolvers-composition@7.0.32
@graphql-tools/resolvers-composition@7.0.33
@graphql-tools/resolvers-composition@7.0.34
@graphql-tools/resolvers-composition@7.0.35
@graphql-tools/resolvers-composition@7.0.36
@graphql-tools/resolvers-composition@7.0.37
@graphql-tools/schema@10.*
@graphql-tools/schema@10.0.27
@graphql-tools/schema@10.0.28
@graphql-tools/schema@10.0.29
@graphql-tools/schema@10.0.30
@graphql-tools/schema@10.0.31
@graphql-tools/schema@10.0.32
@graphql-tools/schema@10.0.33
@graphql-tools/schema@10.0.34
@graphql-tools/schema@10.0.35
@graphql-tools/schema@10.0.36
@graphql-tools/schema@10.0.37
@graphql-tools/schema@10.0.38
@graphql-tools/schema@10.1.0
@graphql-tools/schema@10.1.1
@graphql-tools/url-loader@9.*
@graphql-tools/url-loader@9.0.2
@graphql-tools/url-loader@9.0.3
@graphql-tools/url-loader@9.0.4
@graphql-tools/url-loader@9.0.5
@graphql-tools/url-loader@9.0.6
@graphql-tools/url-loader@9.1.0
@graphql-tools/url-loader@9.1.1
@graphql-tools/url-loader@9.1.10
@graphql-tools/url-loader@9.1.2
@graphql-tools/url-loader@9.1.3
@graphql-tools/url-loader@9.1.4
@graphql-tools/url-loader@9.1.5
@graphql-tools/url-loader@9.1.6
@graphql-tools/url-loader@9.1.7
@graphql-tools/url-loader@9.1.8
@graphql-tools/url-loader@9.1.9
@graphql-tools/utils@10.*
@graphql-tools/utils@10.10.1
@graphql-tools/utils@10.10.2
@graphql-tools/utils@10.10.3
@graphql-tools/utils@10.11.0
@graphql-tools/utils@11.*
@graphql-tools/utils@11.0.0
@graphql-tools/utils@11.0.1
@graphql-tools/utils@11.1.0
@graphql-tools/utils@11.1.1
@graphql-tools/utils@11.2.0
@graphql-tools/utils@11.2.1
@graphql-tools/utils@11.2.2
@graphql-tools/utils@12.*
@graphql-tools/utils@12.0.0
@graphql-tools/utils@12.0.1
@graphql-tools/webpack-loader-runtime@7.*
@graphql-tools/webpack-loader-runtime@7.0.1
@graphql-tools/webpack-loader@7.*
@graphql-tools/webpack-loader@7.0.1
graphql-tools@9.*
graphql-tools@9.0.22
graphql-tools@9.0.23
graphql-tools@9.0.24
graphql-tools@9.0.25
graphql-tools@9.0.26
graphql-tools@9.0.27
graphql-tools@9.0.28
graphql-tools@9.0.29
graphql-tools@9.0.30
graphql-tools@9.0.31
graphql-tools@9.0.32
graphql-tools@9.0.33
graphql-tools@9.0.34
graphql-tools@9.0.35
Other
release-1762270964217
release-1762898070675
release-1762942062826
release-1763693142685
release-1764324313752
release-1767748441422
release-1772723897561
release-1772725596254
release-1772806937546
release-1775215751665
release-1775728135704
release-1776944279203
release-1782659362754
release-1783333847683
release-1783508322941
release-1784299519089
release-1784324814657
release-1786551475000
release-1788796992000
release-1788866667000
release-1788957716000
release-1789688185000

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-114604.json"