{"action":"Upgrade @graphql-tools/utils to 12.0.2 or later.","affected":[{"fixed":"12.0.2","introduced":"10.10.1"}],"component":"@graphql-tools/utils","cve_ids":["CVE-2026-114604"],"ecosystem":"npm","exploited":false,"fixed_versions":["12.0.2"],"ghsa_id":"GHSA-c4qx-w738-7hr3","id":"tcs_01M5JMD0QJW6X45BJPY7YWZS4H","modified_at":"2026-10-22T16:45:03.723714528Z","published_at":"2026-10-22T16:28:31Z","references":["https://osv.dev/vulnerability/GHSA-c4qx-w738-7hr3","https://github.com/ardatan/graphql-tools/security/advisories/GHSA-c4qx-w738-7hr3","https://github.com/ardatan/graphql-tools/pull/8467","https://github.com/ardatan/graphql-tools/commit/19f5b3373fd7ace0688d19950fc529ce8347952a","https://github.com/ardatan/graphql-tools/commit/20d36a5c6eb8fd5524420988e01a48618c450d70","https://github.com/ardatan/graphql-tools","https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/utils@12.0.2"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-c4qx-w738-7hr3","url":"https://osv.dev/vulnerability/GHSA-c4qx-w738-7hr3"}],"summary":"GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments"}