Is @apollo/server 4.1 vulnerable?

npm · 2 releases from 4.1.0 to 4.1.1 · latest @apollo/server is 5.5.1 · checked 2 Nov 2026

Yes: 2 known advisories

Yes. @apollo/server 4.1.1, the last 4.1 release, is affected by 2 known security advisories (1 medium, 1 low). Upgrade to 5.5.0 or later to fix all of them.

Upgrade with:npm install @apollo/server@5.5.0

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting @apollo/server 4.1.1

  • MediumGHSA-9q82-xgwf-vj6h26 Mar 2026

    Apollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention

    Affected
    <5.5.0
    Fixed in
    5.5.0
  • LowGHSA-j5g3-5c8r-7qfx30 Aug 2023

    Prevent logging invalid header values

    Affected
    <4.9.3
    Fixed in
    4.9.3

Which of your client projects are still on @apollo/server 4.1?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact @apollo/server version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other @apollo/server versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.