Is @apollo/server 4.4 vulnerable?

npm · 2 releases from 4.4.0 to 4.4.1 · latest @apollo/server is 5.5.1 · checked 2 Nov 2026

Yes: 3 known advisories

Yes. @apollo/server 4.4.1, the last 4.4 release, is affected by 3 known security advisories (1 high, 1 medium, 1 low), including CVE-2026-23897. Upgrade to 5.5.0 or later to fix all of them.

Upgrade with:npm install @apollo/server@5.5.0

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting @apollo/server 4.4.1

  • MediumGHSA-9q82-xgwf-vj6h26 Mar 2026

    Apollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention

    Affected
    <5.5.0
    Fixed in
    5.5.0
  • HighCVE-2026-23897GHSA-mp6q-xf9x-fwf74 Feb 2026

    Apollo Serve vulnerable to Denial of Service with `startStandaloneServer`

    Affected
    >=4.2.0 <4.13.0 · >=5.0.0 <5.4.0
    Fixed in
    4.13.0, 5.4.0
  • LowGHSA-j5g3-5c8r-7qfx30 Aug 2023

    Prevent logging invalid header values

    Affected
    <4.9.3
    Fixed in
    4.9.3

Which of your client projects are still on @apollo/server 4.4?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact @apollo/server version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other @apollo/server versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.