Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-104852— GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

Quick assessment

Affected
ardatan graphql-tools
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

GraphQL Tools 提供用于构建、拼接和模拟 GraphQL 模式（schema）的工具。在版本 12.0.1 之前，GraphQL Tools 工具包中的 函数在递归合并源对象时会遵循继承属性，且未排除 、 或 等键。未经过身份验证的 GraphQL 客户端可以通过将字段别名为这些名称，使得在普通超图（supergraph）结果合并过程中，来自两个子图的响应发生冲突，导致 遍历 和 的原型链，并用子图提供的值覆盖 。这将导致进程中后续请求中断，直到服务重启才能恢复。该问题已在版本 12.0.1 中修复。

CVSS 8.2 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-104852

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`
Source: CVE Program / CVE List V5
Vulnerability Description
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude __proto__, constructor, or prototype keys. An unauthenticated GraphQL client can alias fields to those names so responses from two subgraphs collide during ordinary supergraph result merging, causing mergeDeep to traverse Object and Function prototypes and overwrite Function.prototype.call with a subgraph-supplied value. This breaks subsequent requests in the process until restart. This issue is fixed in version 12.0.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1321
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ardatan graphql-tools < 12.0.1 -

II. Public POCs for CVE-2026-104852

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-104852

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-104852 (3)

Vendor Advisories for CVE-2026-104852 (1)

Other References for CVE-2026-104852 (1)

IV. Related Vulnerabilities

Same product: graphql-tools
Same vendor: ardatan
Same weakness: CWE-1321

V. Comments for CVE-2026-104852

No comments yet

Leave a comment