Is @apollo/server 4.12 vulnerable?

npm · 3 releases from 4.12.0 to 4.12.2 · latest @apollo/server is 5.5.1 · checked 1 Nov 2026

Yes: 2 known advisories

Yes. @apollo/server 4.12.2, the last 4.12 release, is affected by 2 known security advisories (1 high, 1 medium), including CVE-2026-23897. Upgrade to 5.5.0 or later to fix all of them.

Upgrade with:npm install @apollo/server@5.5.0

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting @apollo/server 4.12.2

  • MediumGHSA-9q82-xgwf-vj6h26 Mar 2026

    Apollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention

    Affected
    <5.5.0
    Fixed in
    5.5.0
  • HighCVE-2026-23897GHSA-mp6q-xf9x-fwf74 Feb 2026

    Apollo Serve vulnerable to Denial of Service with `startStandaloneServer`

    Affected
    >=4.2.0 <4.13.0 · >=5.0.0 <5.4.0
    Fixed in
    4.13.0, 5.4.0

Which of your client projects are still on @apollo/server 4.12?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact @apollo/server version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other @apollo/server versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.