CyberRota Analysis
AI-GeneratedThe mergeDeep function in GraphQL Tools prior to version 12.0.1 is vulnerable to prototype pollution, allowing unauthenticated clients to manipulate the merging process of GraphQL schemas. This can lead to the overwriting of critical JavaScript functions, such as Function.prototype.call, resulting in application instability until a restart occurs. Organizations using affected versions of GraphQL Tools should prioritize upgrading to version 12.0.1 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude __proto__, constructor, or prototype keys. An unauthenticated GraphQL client can alias fields to those names so responses from two subgraphs collide during ordinary supergraph result merging, causing mergeDeep to traverse Object and Function prototypes and overwrite Function.prototype.call with a subgraph-supplied value. This breaks subsequent requests in the process until restart. This issue is fixed in version 12.0.1.