Is @apollo/server 4.13 vulnerable?

npm · 1 release from 4.13.0 to 4.13.0 · latest @apollo/server is 5.5.1 · checked 1 Nov 2026

Yes: 1 known advisory

Yes. @apollo/server 4.13.0, the last 4.13 release, is affected by 1 known security advisory (1 medium). Upgrade to 5.5.0 or later to fix all of them.

Upgrade with:npm install @apollo/server@5.5.0

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting @apollo/server 4.13.0

  • MediumGHSA-9q82-xgwf-vj6h26 Mar 2026

    Apollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention

    Affected
    <5.5.0
    Fixed in
    5.5.0

Which of your client projects are still on @apollo/server 4.13?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact @apollo/server version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other @apollo/server versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.