npm/apollo-server: medium
The graphql-upload library included in Apollo Server 2 is vulnerable to CSRF mutations
Action: Upgrade apollo-server to 2.25.4 or later.
npm i apollo-server@2.25.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.0 | 2.25.4 | - |
Fixed versions
| 2.25.4 |
Sources
- osv: GHSA-2p3c-p3qw-69r4
- https://github.com/apollographql/apollo-server/security/advisories/GHSA-2p3c-p3qw-69r4
- https://github.com/jaydenseric/graphql-multipart-request-spec/pull/64
- https://github.com/apollographql/apollo-server/commit/82d44985ddca8e61557957d67f41e9c1a705a5ca
- https://github.com/apollographql/apollo-server
published · modified · JSON