npm/@apollo/server: medium

Apollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention

Action: Upgrade @apollo/server to 5.5.0 or later.

npm i @apollo/server@5.5.0

Affected

Fixed versions

Sources

• osv: GHSA-9q82-xgwf-vj6h
• https://github.com/apollographql/apollo-server/security/advisories/GHSA-9q82-xgwf-vj6h
• https://github.com/apollographql/router/security/advisories/GHSA-hff2-gcpx-8f4p
• https://github.com/apollographql/apollo-server/commit/ada12001c4e95b5c779d80314a5a32e33087b5cf
• https://github.com/apollographql/apollo-server
• https://github.com/apollographql/apollo-server/releases/tag/@apollo/server@5.5.0
• https://www.apollographql.com/docs/apollo-server/previous-versions

published 2026-03-26T21:53:10Z · modified 2026-03-26T22:04:38.962071Z · JSON