Is apollo-server 2.14 vulnerable?
npm · 6 releases from 2.14.0 to 2.14.5 · latest apollo-server is 3.13.0 · checked 1 Nov 2026
Yes: 3 known advisories
Yes. apollo-server 2.14.5, the last 2.14 release, is affected by 3 known security advisories (2 high, 1 medium), including CVE-2026-23897. 1 more affects earlier 2.14.x releases. At least one has no fixed release yet.
Advisories affecting apollo-server 2.14.5
Apollo Serve vulnerable to Denial of Service with `startStandaloneServer`
- Affected
- >=2.0.0 <=3.13.0
- Fixed in
- No fix released
The graphql-upload library included in Apollo Server 2 is vulnerable to CSRF mutations
- Affected
- >=2.0.0 <2.25.4
- Fixed in
- 2.25.4
Cross-site Scripting Vulnerability in GraphQL Playground (distributed by Apollo Server)
- Affected
- >=2.0.0 <2.25.3 · >=3.0.0 <3.4.1
- Fixed in
- 2.25.3, 3.4.1
Fixed within 2.14.x, affecting earlier releases
Introspection in schema validation in Apollo Server
- Affected
- <2.14.2
- Fixed in
- 2.14.2
Which of your client projects are still on apollo-server 2.14?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact apollo-server version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other apollo-server versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.