npm/@graphql-tools/utils CVE-2026-114604: high

GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

Action: Upgrade @graphql-tools/utils to 12.0.2 or later.

npm i @graphql-tools/utils@12.0.2

Affected

Fixed versions

Sources

• osv: GHSA-c4qx-w738-7hr3
• https://github.com/ardatan/graphql-tools/security/advisories/GHSA-c4qx-w738-7hr3
• https://github.com/ardatan/graphql-tools/pull/8467
• https://github.com/ardatan/graphql-tools/commit/19f5b3373fd7ace0688d19950fc529ce8347952a
• https://github.com/ardatan/graphql-tools/commit/20d36a5c6eb8fd5524420988e01a48618c450d70
• https://github.com/ardatan/graphql-tools
• https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/utils@12.0.2

CVE-2026-114604 · published 2026-10-22T16:28:31Z · modified 2026-10-22T16:45:03.723714528Z · JSON