{"action":"Upgrade apollo-router to 1.61.13 or later.","affected":[{"fixed":"2.12.1","introduced":"2.11.0"},{"fixed":"2.10.2","introduced":"2.0.0"},{"fixed":"1.61.13","introduced":"0"}],"component":"apollo-router","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["2.12.1","2.10.2","1.61.13"],"ghsa_id":"GHSA-hff2-gcpx-8f4p","id":"tcs_01M5KF0GHM9752AJ8GY8C6HRZZ","modified_at":"2026-03-26T22:21:15.256082Z","published_at":"2026-03-26T22:09:01Z","references":["https://osv.dev/vulnerability/GHSA-hff2-gcpx-8f4p","https://github.com/apollographql/apollo-server/security/advisories/GHSA-9q82-xgwf-vj6h","https://github.com/apollographql/router/security/advisories/GHSA-hff2-gcpx-8f4p","https://github.com/apollographql/router/commit/a72e759bcdeef93fcd3dc928cf3c1f4bbebdcc65","https://github.com/apollographql/router","https://github.com/apollographql/router/releases/tag/v2.12.1","https://www.apollographql.com/docs/graphos/resources/runtime-release-lifecycle#end-of-support-eos"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-hff2-gcpx-8f4p","url":"https://osv.dev/vulnerability/GHSA-hff2-gcpx-8f4p"}],"summary":"Apollo Router Core: Browser Bug Enables Bypass of XS-Search Prevention via Read-Only Cross-Site Request Forgery"}