GHSA-W42G-7VFC-XF37

Introspection in schema validation in Apollo Server

const server = new ApolloServer({
  subscriptions: false,
  /* Other options, such as typeDefs, resolvers, schema, etc. */
});

If subscriptions: false is passed to the ApolloServer constructor options, there is no impact. If implementors were not expecting validation rules to be enforced on the WebSocket subscriptions transport and are unconcerned about introspection being enabled on the WebSocket subscriptions transport (or were not expecting that), then this advisory is not applicable. If introspection: true is passed to the ApolloServer constructor options, the impact is limited to user-provided validation rules (i.e., using validationRules) since there would be no expectation that introspection was disabled.

The enforcement of user-provided validation rules on the HTTP transport is working as intended and is unaffected by this advisory. Similarly, disabling introspection on the HTTP transport is working as intended and is unaffected by this advisory.

Note: Unless subscriptions: false is explicitly passed to the constructor parameters of new ApolloServer({ ... }), subscriptions are enabled by default, whether or not there is a Subscription type present in the schema. As an alternative to upgrading to a patched version, see the Workarounds section below to disable subscriptions if it is not necessary.

In cases where subscriptions: false is not explicitly set, the subscription server is impacted since validation rules which are enforced on the main request pipeline within Apollo Server were not being passed to the SubscriptionServer.create invocation (seen here, prior to the patch).

The omitted validation rules for the subscription server include any validationRules passed by implementors to the ApolloServer constructor which were expected to be enforced on the subscriptions WebSocket endpoint. Additionally, because an internal NoIntrospection validation rule is used to disable introspection, it would have been possible to introspect a server on the WebSocket endpoint that the SubscriptionServer creates even though it was not possible on other transports (e.g. HTTP).

The severity of risk depends on whether sensitive information is being stored in the schema itself. The contents of schema descriptions, or secrets which might be revealed by the names of types or field names within those types, will determine the risk to individual implementors.

Kodem intelligence

Already deployed Kodem?

1. What is GHSA-W42G-7VFC-XF37? GHSA-W42G-7VFC-XF37 is a medium-severity security vulnerability in apollo-server (npm), affecting versions < 2.14.2. It is fixed in 2.14.2.
2. Which packages are affected by GHSA-W42G-7VFC-XF37?
   • apollo-server (npm) (versions < 2.14.2)
   • apollo-server-azure-functions (npm) (versions < 2.14.2)
   • apollo-server-cache-memcached (npm) (versions < 2.14.2)
   • apollo-server-core (npm) (versions < 2.14.2)
   • apollo-server-cloud-functions (npm) (versions < 2.14.2)
   • apollo-server-cloudflare (npm) (versions < 2.14.2)
   • apollo-server-express (npm) (versions < 2.14.2)
   • apollo-server-fastify (npm) (versions < 2.14.2)
   • apollo-server-hapi (npm) (versions < 2.14.2)
   • apollo-server-koa (npm) (versions < 2.14.2)
   • apollo-server-lambda (npm) (versions < 2.14.2)
   • apollo-server-micro (npm) (versions < 2.14.2)
3. Is there a fix for GHSA-W42G-7VFC-XF37? Yes. GHSA-W42G-7VFC-XF37 is fixed in 2.14.2. Upgrade to this version or later.
4. Is GHSA-W42G-7VFC-XF37 exploitable, and should I be worried? Whether GHSA-W42G-7VFC-XF37 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether GHSA-W42G-7VFC-XF37 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix GHSA-W42G-7VFC-XF37?
   • Upgrade apollo-server to 2.14.2 or later
   • Upgrade apollo-server-azure-functions to 2.14.2 or later
   • Upgrade apollo-server-cache-memcached to 2.14.2 or later
   • Upgrade apollo-server-core to 2.14.2 or later
   • Upgrade apollo-server-cloud-functions to 2.14.2 or later
   • Upgrade apollo-server-cloudflare to 2.14.2 or later
   • Upgrade apollo-server-express to 2.14.2 or later
   • Upgrade apollo-server-fastify to 2.14.2 or later
   • Upgrade apollo-server-hapi to 2.14.2 or later
   • Upgrade apollo-server-koa to 2.14.2 or later
   • Upgrade apollo-server-lambda to 2.14.2 or later
   • Upgrade apollo-server-micro to 2.14.2 or later

Other vulnerabilities in apollo-server