{"action":"Upgrade @apollo/experimental-nextjs-app-support to 0.7.0 or later.","affected":[{"fixed":"0.7.0","introduced":"0"}],"component":"@apollo/experimental-nextjs-app-support","cve_ids":["CVE-2024-23841"],"ecosystem":"npm","epss":0.00385,"exploited":false,"fixed_versions":["0.7.0"],"ghsa_id":"GHSA-rv8p-rr2h-fgpg","id":"tcs_01M5KG9Y37XZ75ZMTZNGWC1F8G","modified_at":"2026-09-10T03:50:05.174016048Z","published_at":"2024-01-30T20:57:45Z","references":["https://osv.dev/vulnerability/GHSA-rv8p-rr2h-fgpg","https://github.com/apollographql/apollo-client-nextjs/security/advisories/GHSA-rv8p-rr2h-fgpg","https://nvd.nist.gov/vuln/detail/CVE-2024-23841","https://github.com/apollographql/apollo-client-nextjs/commit/b92bc42abd5f8e17d4db361c36bd08e4f541a46b","https://github.com/apollographql/apollo-client-nextjs"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-rv8p-rr2h-fgpg","url":"https://osv.dev/vulnerability/GHSA-rv8p-rr2h-fgpg"}],"summary":"@apollo/experimental-nextjs-app-support Cross-site Scripting vulnerability"}