CVE-2026-32621: 
JavaScript vulnerability analysis and mitigation

CVE-2026-32621 is a prototype pollution vulnerability in Apollo Federation's query plan execution within the gateway, classified as Critical with a CVSS v3.1 base score of 9.9. It affects the npm packages @apollo/federation-internals, @apollo/gateway, and @apollo/query-planner across versions prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2. The vulnerability was published on March 13, 2026, by researcher r3dbrothers via the GitHub Security Advisory GHSA-pfjj-6f4p-rvmh, and was added to the NVD on March 16, 2026 (GitHub Advisory, Apollo Advisory).

The root cause is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes), stemming from incomplete key sanitization during query plan execution in the Apollo Gateway. An authenticated malicious client can directly pollute Object.prototype by crafting GraphQL operations with field aliases or variable names that correspond to prototype-inheritable properties (e.g., __proto__, constructor, prototype). Alternatively, if a subgraph is compromised, an attacker can inject malicious JSON response payloads targeting these same prototype-inheritable properties, which the gateway then processes without adequate sanitization. Because Object.prototype is shared across the entire Node.js process, a single successful pollution event can affect all subsequent request handling within that process (GitHub Advisory, Apollo Advisory).

Successful exploitation corrupts Object.prototype across the Node.js process, meaning all subsequent requests to the gateway instance are affected — not just the attacker's own session. This process-wide impact can lead to privilege escalation, data integrity compromise, unexpected application behavior, and potentially sensitive data exposure depending on how downstream application code or dependencies consume the polluted properties. The changed scope (S:C) in the CVSS score reflects that the impact extends beyond the vulnerable component itself to the broader application environment (GitHub Advisory, Apollo Advisory).

As of the advisory date, Apollo is not aware of any reported exploitation of this vulnerability in the wild, and no public proof-of-concept exploit has been identified (GitHub Advisory). Exploitation requires low privileges (an authenticated client or a compromised subgraph), no user interaction, and low attack complexity over the network. The EPSS score is approximately 0.029–0.043%, placing it in the 13th percentile for exploitation likelihood within 30 days. The CVE status is currently listed as "Deferred" and it has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify Apollo Federation gateway instances by probing GraphQL endpoints for introspection responses or error messages that reveal Apollo Federation version information.
2. Authenticate or obtain access: Obtain low-privilege credentials or API access to the target Apollo Gateway, as the vulnerability requires at least low-level privileges.
3. Craft a malicious GraphQL operation: Construct a GraphQL query or mutation that uses field aliases or variable names targeting prototype-inheritable properties, such as __proto__, constructor, or prototype. For example, use a field alias like __proto__ pointing to a field that returns attacker-controlled data.
4. Submit the crafted operation: Send the malicious GraphQL operation to the gateway endpoint. The gateway's query plan executor processes the operation without fully sanitizing the prototype-targeting keys.
5. Pollute Object.prototype: The gateway assigns attacker-controlled values to properties on Object.prototype, which is shared across the Node.js process.
6. Achieve secondary impact: Subsequent requests to the gateway — from any user — may behave unexpectedly due to the polluted prototype, potentially enabling privilege escalation, bypassing authorization checks, or corrupting application logic depending on how the application consumes inherited properties (Apollo Advisory, GitHub Advisory).

• Network: Unusual GraphQL requests to the gateway containing field aliases or variable names matching __proto__, constructor, or prototype; unexpected outbound connections from the gateway Node.js process.
• Logs: GraphQL access logs showing operations with suspicious field alias names (e.g., __proto__, constructor, prototype) in query bodies; error logs indicating unexpected property access or type mismatches in subsequent requests after a suspicious operation.
• Application Behavior: Sudden changes in authorization behavior or access control decisions for requests following a suspicious GraphQL operation; unexpected application errors or crashes in the Node.js gateway process attributable to prototype property conflicts.
• Subgraph Responses: JSON response payloads from subgraphs containing keys such as __proto__, constructor, or prototype at unexpected nesting levels, which may indicate a compromised subgraph attempting to pollute the gateway (Apollo Advisory).

Patches have been released in @apollo/federation-internals, @apollo/gateway, and @apollo/query-planner versions 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2; users should upgrade to one of these patched versions at the earliest opportunity. For those unable to upgrade immediately, Apollo recommends placing an input validation layer in front of the gateway to filter GraphQL operations containing names matching known prototype pollution patterns (e.g., __proto__, constructor, prototype). Additionally, operators should ensure all subgraphs in their federated graph originate from trusted sources to prevent the compromised-subgraph attack vector. Note that no fully effective workaround exists without a code change (GitHub Advisory, Apollo Advisory).

The vulnerability was reported by researcher r3dbrothers and disclosed by Apollo via GitHub Security Advisories on March 13, 2026. Social media activity was observed on Mastodon (via @thehackerwire and @Matchbook3469) shortly after disclosure, indicating community awareness. A threat intelligence write-up was published at yazoul.net covering the advisory details. No major vendor statements beyond Apollo's own advisory or significant media coverage have been identified at this time (Apollo Advisory).