Is apollo-server 3.1 vulnerable?

npm · 3 releases from 3.1.0 to 3.1.2 · latest apollo-server is 3.13.0 · checked 1 Nov 2026

Yes: 2 known advisories

Yes. apollo-server 3.1.2, the last 3.1 release, is affected by 2 known security advisories (2 high), including CVE-2026-23897. At least one has no fixed release yet.

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting apollo-server 3.1.2

  • HighCVE-2026-23897GHSA-mp6q-xf9x-fwf74 Feb 2026

    Apollo Serve vulnerable to Denial of Service with `startStandaloneServer`

    Affected
    >=2.0.0 <=3.13.0
    Fixed in
    No fix released
  • HighGHSA-qm7x-rc44-rrqw8 Nov 2021

    Cross-site Scripting Vulnerability in GraphQL Playground (distributed by Apollo Server)

    Affected
    >=2.0.0 <2.25.3 · >=3.0.0 <3.4.1
    Fixed in
    2.25.3, 3.4.1

Which of your client projects are still on apollo-server 3.1?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact apollo-server version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other apollo-server versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.