CVE-2026-114604— GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

Quick assessment

Affected

ardatan graphql-tools

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

GraphQL Tools 提供用于构建、拼接和模拟 GraphQL 模式的工具。在版本 10.10.1 到 12.0.2 之间，包中的辅助函数会将的分段传递给，但缺少运行时对基本类型的验证。非基本类型的分段可以绕过对、和的严格比较，并在属性访问时被隐式转换，从而使恶意或已被攻陷的上游增量 GraphQL 响应将攻击者控制的属性写入消费端 Node.js 进程中的。受影响的实现位于，当消费者合并不可信的或传输结果时即可触发此问题。该问题已在版本 12.0.2 中修复。

CVSS 8.4 · High EPSS 0.52% · P44 Updated Nov 06, 2026

Possible ATT&CK Techniques 2 AI

T1203 · Exploitation for Client Execution T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
ardatan	graphql-tools	`>= 10.10.1, < 12.0.2`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

Source: CVE Program / CVE List V5

Vulnerability Description

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. From 10.10.1 until 12.0.2, the @graphql-tools/utils mergeIncrementalResult helper passes incrementalResult.path segments to setObjectKeyPath without runtime primitive-type validation. A non-primitive segment can bypass strict comparisons against __proto__, constructor, and prototype, then be coerced during property access so a malicious or compromised upstream incremental GraphQL response writes attacker-controlled properties to Object.prototype in the consuming Node.js process. The affected implementation is packages/utils/src/mergeIncrementalResult.ts and is reachable when consumers merge untrusted @defer or @stream transport results. This issue is fixed in version 12.0.2.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

CWE-1321

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ardatan	graphql-tools	>= 10.10.1, < 12.0.2	-

II. Public POCs for CVE-2026-114604

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-114604

请登录查看更多情报信息。

Other References for CVE-2026-114604 (5)

https://github.com/ardatan/graphql-tools/pull/8467 x_refsource_MISC
https://github.com/ardatan/graphql-tools/security/advisories/GHSA-c4qx-w738-7hr3 x_refsource_CONFIRM
https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/utils@12.0.2 x_refsource_MISC
https://github.com/ardatan/graphql-tools/commit/19f5b3373fd7ace0688d19950fc529ce8347952a x_refsource_MISC
https://github.com/ardatan/graphql-tools/commit/20d36a5c6eb8fd5524420988e01a48618c450d70 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-114604

IV. Related Vulnerabilities

Same product: graphql-tools

Same vendor: ardatan

Same weakness: CWE-1321