CVE-2026-23897: 
JavaScript vulnerability analysis and mitigation

CVE-2026-23897 is a Denial of Service (DoS) vulnerability in Apollo Server's startStandaloneServer function, caused by inefficient regular expression complexity (CWE-1333) when processing HTTP request bodies with exotic character set encodings. It affects @apollo/server versions 4.2.0 to before 4.13.0 and 5.0.0 to before 5.4.0, as well as all releases of the end-of-life apollo-server npm package versions 2.0.0 through 3.13.0. The vulnerability was published on February 4, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, GitHub Security Advisory).

The root cause is classified as CWE-1333 (Inefficient Regular Expression Complexity), mapped to CAPEC-492 (Regular Expression Exponential Blowup). The startStandaloneServer function in @apollo/server/standalone did not validate or restrict the character set encoding of incoming JSON request bodies, allowing attackers to send specially crafted HTTP requests with exotic (non-standard) character set encodings that trigger catastrophic backtracking in regular expression processing, consuming excessive CPU cycles. The vulnerability is network-accessible, requires no authentication or user interaction, and only affects direct usage of startStandaloneServer — users relying on integration packages such as @as-integrations/express5 or @as-integrations/next are not affected. The fix enforces acceptance of only RFC 7159-compliant encodings (UTF-8, UTF-16 LE/BE, UTF-32 LE/BE), rejecting all others with a 415 Unsupported Media Type error (Github Advisory, Patch Commit).

Successful exploitation results in high availability impact — an unauthenticated remote attacker can crash or severely degrade standalone Apollo Server instances by sending crafted HTTP requests, rendering GraphQL endpoints unavailable. There is no confidentiality or integrity impact; the attack is purely a denial of service. The scope is limited to deployments using startStandaloneServer directly, but such instances may serve as critical API gateways, making downtime operationally significant (Github Advisory, GitHub Security Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.054% (17th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The attack requires no privileges or user interaction and is reachable over the network, making it relatively straightforward to attempt once a target is identified.

1. Reconnaissance: Identify internet-facing Apollo Server instances using startStandaloneServer (e.g., via Shodan, Censys, or by probing GraphQL endpoints for Apollo Server fingerprints in response headers or error messages).
2. Confirm vulnerability: Verify the target is running an affected version of @apollo/server (4.2.0–4.12.x or 5.0.0–5.3.x) or apollo-server (2.x–3.13.0) using version disclosure in error responses or npm audit data.
3. Craft malicious request: Construct an HTTP POST request to the GraphQL endpoint with a Content-Type header specifying an exotic, non-standard character set encoding (e.g., Content-Type: application/json; charset=<exotic-encoding>) and a request body designed to trigger exponential regex backtracking during charset validation.
4. Send the request: Transmit the crafted request to the target's GraphQL endpoint. The server's inefficient regular expression processing will consume excessive CPU, causing the server to become unresponsive or crash.
5. Sustain DoS: Repeat or flood the server with such requests to maintain denial of service, preventing legitimate users from accessing the GraphQL API (Github Advisory, Patch Commit).

• Network: Unusual HTTP POST requests to GraphQL endpoints with Content-Type headers specifying non-standard or exotic character set encodings (e.g., anything other than utf-8, utf-16, utf-32); high-volume or repeated requests from a single source IP targeting the GraphQL endpoint.
• Logs: Server access logs showing a spike in POST requests to the GraphQL path with abnormal Content-Type values; application logs showing increased CPU usage or timeout errors coinciding with specific request patterns.
• Process: Node.js process consuming abnormally high CPU (near 100%) without a corresponding increase in legitimate traffic; server becoming unresponsive or restarting unexpectedly.

Upgrade @apollo/server to version 4.13.0 or 5.4.0 (or later), which enforce RFC 7159-compliant character set validation and reject unsupported encodings with a 415 Unsupported Media Type error. For users of the legacy apollo-server v2 or v3 packages (which are EOL and will not receive patches), the recommended workaround is to migrate to an integration package such as apollo-server-express or apollo-server-koa and configure charset validation at the web framework level. As a temporary network-level measure, deploy WAF rules to block HTTP requests with non-standard Content-Type charset values targeting GraphQL endpoints. Apollo also recommends using startStandaloneServer only for prototyping and migrating production deployments to a fully-featured web framework (Express, Koa, Fastify) for greater security control (Github Advisory, GitHub Security Advisory).

The advisory was published by Apollo maintainer phryneas on February 4, 2026, with credit to reporter ChALkeR. The patch commit notes explicitly recommend against using startStandaloneServer in production, advising users to migrate to more fully-featured web frameworks for better security control. Red Hat acknowledged the CVE on February 5, 2026. Social media activity was limited, with brief mentions on Bluesky shortly after disclosure (GitHub Security Advisory, Patch Commit).