Is @apollo/server 4.0 vulnerable?

npm · 6 releases from 4.0.0 to 4.0.5 · latest @apollo/server is 5.5.1 · checked 1 Nov 2026

Yes: 3 known advisories

Yes. @apollo/server 4.0.5, the last 4.0 release, is affected by 3 known security advisories (2 medium, 1 low). Upgrade to 5.5.0 or later to fix all of them.

Upgrade with:npm install @apollo/server@5.5.0

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting @apollo/server 4.0.5

  • MediumGHSA-9q82-xgwf-vj6h26 Mar 2026

    Apollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention

    Affected
    <5.5.0
    Fixed in
    5.5.0
  • LowGHSA-j5g3-5c8r-7qfx30 Aug 2023

    Prevent logging invalid header values

    Affected
    <4.9.3
    Fixed in
    4.9.3
  • MediumGHSA-8r69-3cvp-wxc32 Nov 2022

    Batched HTTP requests may set incorrect `cache-control` response header

    Affected
    <4.1.0
    Fixed in
    4.1.0

Which of your client projects are still on @apollo/server 4.0?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact @apollo/server version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other @apollo/server versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.