{"id":"CVE-2026-114604","summary":"GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments","details":"GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. From 10.10.1 until 12.0.2, the @graphql-tools/utils mergeIncrementalResult helper passes incrementalResult.path segments to setObjectKeyPath without runtime primitive-type validation. A non-primitive segment can bypass strict comparisons against __proto__, constructor, and prototype, then be coerced during property access so a malicious or compromised upstream incremental GraphQL response writes attacker-controlled properties to Object.prototype in the consuming Node.js process. The affected implementation is packages/utils/src/mergeIncrementalResult.ts and is reachable when consumers merge untrusted @defer or @stream transport results. This issue is fixed in version 12.0.2.","aliases":["GHSA-c4qx-w738-7hr3"],"modified":"2026-11-11T02:32:14.093132128Z","published":"2026-11-05T20:37:39.814Z","related":["openSUSE-SU-2026:12429-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114604.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-1321"]},"references":[{"type":"WEB","url":"https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/utils@12.0.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114604.json"},{"type":"ADVISORY","url":"https://github.com/ardatan/graphql-tools/security/advisories/GHSA-c4qx-w738-7hr3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114604"},{"type":"FIX","url":"https://github.com/ardatan/graphql-tools/commit/19f5b3373fd7ace0688d19950fc529ce8347952a"},{"type":"FIX","url":"https://github.com/ardatan/graphql-tools/commit/20d36a5c6eb8fd5524420988e01a48618c450d70"},{"type":"FIX","url":"https://github.com/ardatan/graphql-tools/pull/8467"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ardatan/graphql-tools","events":[{"introduced":"5b26b6d00c21dd44efe6e7bb6042c4ddf3b3db5d"},{"fixed":"3a43b4bb24e27c8f2d819d9fb571bf5b772e63b8"},{"fixed":"19f5b3373fd7ace0688d19950fc529ce8347952a"},{"fixed":"20d36a5c6eb8fd5524420988e01a48618c450d70"}],"database_specific":{"extracted_events":[{"strategy":"StringRangeExpression","range":[{"introduced":"10.10.1"},{"fixed":"12.0.2"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"19f5b3373fd7ace0688d19950fc529ce8347952a"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"20d36a5c6eb8fd5524420988e01a48618c450d70"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["release-1789688185000","@graphql-tools/url-loader@9.1.10","@graphql-tools/github-loader@9.1.9","release-1788957716000","@graphql-tools/code-file-loader@8.1.39","release-1788866667000","@graphql-tools/url-loader@9.1.9","@graphql-tools/executor-legacy-ws@1.1.35","release-1788796992000","graphql-tools@9.0.35","@graphql-tools/webpack-loader@7.0.1","@graphql-tools/webpack-loader-runtime@7.0.1","@graphql-tools/utils@12.0.1","@graphql-tools/url-loader@9.1.8","@graphql-tools/schema@10.1.1","@graphql-tools/resolvers-composition@7.0.37","@graphql-tools/relay-operation-optimizer@7.1.10","@graphql-tools/optimize@2.0.1","@graphql-tools/node-require@7.0.46","@graphql-tools/module-loader@8.0.34","@graphql-tools/mock@9.1.14","@graphql-tools/merge@9.2.4","@graphql-tools/load@8.1.17","@graphql-tools/links@10.0.14","@graphql-tools/json-file-loader@8.0.34","@graphql-tools/jest-transform@2.0.2","@graphql-tools/import@7.2.0","@graphql-tools/graphql-tag-pluck@8.3.37","@graphql-tools/graphql-file-loader@8.1.20","@graphql-tools/github-loader@9.1.8","@graphql-tools/git-loader@8.0.42","@graphql-tools/executor@2.0.1","@graphql-tools/executor-yoga@3.0.44","@graphql-tools/executor-urql-exchange@1.0.36","@graphql-tools/executor-legacy-ws@1.1.34","@graphql-tools/executor-envelop@4.0.14","@graphql-tools/executor-apollo-link@2.0.14","@graphql-tools/documents@1.0.2","@graphql-tools/code-file-loader@8.1.38","@graphql-tools/apollo-engine-loader@8.0.36","graphql-tools@9.0.34","@graphql-tools/utils@12.0.0","@graphql-tools/url-loader@9.1.7","@graphql-tools/schema@10.1.0","@graphql-tools/resolvers-composition@7.0.36","@graphql-tools/relay-operation-optimizer@7.1.9","@graphql-tools/node-require@7.0.45","@graphql-tools/module-loader@8.0.33","@graphql-tools/mock@9.1.13","@graphql-tools/merge@9.2.3","@graphql-tools/load@8.1.16","@graphql-tools/links@10.0.13","@graphql-tools/json-file-loader@8.0.33","@graphql-tools/import@7.1.19","@graphql-tools/graphql-tag-pluck@8.3.36","@graphql-tools/graphql-file-loader@8.1.19","@graphql-tools/github-loader@9.1.7","@graphql-tools/git-loader@8.0.41","@graphql-tools/executor@2.0.0","@graphql-tools/executor-yoga@3.0.43","@graphql-tools/executor-urql-exchange@1.0.35","@graphql-tools/executor-legacy-ws@1.1.33","@graphql-tools/executor-envelop@4.0.13","@graphql-tools/executor-apollo-link@2.0.13","@graphql-tools/code-file-loader@8.1.37","@graphql-tools/apollo-engine-loader@8.0.35","release-1786551475000","release-1784324814657","graphql-tools@9.0.33","@graphql-tools/utils@11.2.2","@graphql-tools/url-loader@9.1.6","@graphql-tools/schema@10.0.38","@graphql-tools/resolvers-composition@7.0.35","@graphql-tools/relay-operation-optimizer@7.1.8","@graphql-tools/node-require@7.0.44","@graphql-tools/module-loader@8.0.32","@graphql-tools/mock@9.1.12","@graphql-tools/merge@9.2.2","@graphql-tools/load@8.1.15","@graphql-tools/links@10.0.12","@graphql-tools/json-file-loader@8.0.32","@graphql-tools/import@7.1.18","@graphql-tools/graphql-tag-pluck@8.3.35","@graphql-tools/graphql-file-loader@8.1.18","@graphql-tools/github-loader@9.1.6","@graphql-tools/git-loader@8.0.40","@graphql-tools/executor@1.5.7","@graphql-tools/executor-yoga@3.0.42","@graphql-tools/executor-urql-exchange@1.0.34","@graphql-tools/executor-legacy-ws@1.1.32","@graphql-tools/executor-envelop@4.0.12","@graphql-tools/executor-apollo-link@2.0.12","@graphql-tools/code-file-loader@8.1.36","@graphql-tools/apollo-engine-loader@8.0.34","release-1784299519089","graphql-tools@9.0.32","@graphql-tools/utils@11.2.1","@graphql-tools/url-loader@9.1.5","@graphql-tools/schema@10.0.37","@graphql-tools/resolvers-composition@7.0.34","@graphql-tools/relay-operation-optimizer@7.1.7","@graphql-tools/node-require@7.0.43","@graphql-tools/module-loader@8.0.31","@graphql-tools/mock@9.1.11","@graphql-tools/merge@9.2.1","@graphql-tools/load@8.1.14","@graphql-tools/links@10.0.11","@graphql-tools/json-file-loader@8.0.31","@graphql-tools/import@7.1.17","@graphql-tools/graphql-tag-pluck@8.3.34","@graphql-tools/graphql-file-loader@8.1.17","@graphql-tools/github-loader@9.1.5","@graphql-tools/git-loader@8.0.39","@graphql-tools/executor@1.5.6","@graphql-tools/executor-yoga@3.0.41","@graphql-tools/executor-urql-exchange@1.0.33","@graphql-tools/executor-legacy-ws@1.1.31","@graphql-tools/executor-envelop@4.0.11","@graphql-tools/executor-apollo-link@2.0.11","@graphql-tools/code-file-loader@8.1.35","@graphql-tools/apollo-engine-loader@8.0.33","@ardatan/relay-compiler@13.0.2","release-1783508322941","graphql-tools@9.0.31","@graphql-tools/schema@10.0.36","@graphql-tools/node-require@7.0.42","@graphql-tools/mock@9.1.10","@graphql-tools/merge@9.2.0","@graphql-tools/load@8.1.13","release-1783333847683","graphql-tools@9.0.30","@graphql-tools/utils@11.2.0","@graphql-tools/url-loader@9.1.4","@graphql-tools/schema@10.0.35","@graphql-tools/resolvers-composition@7.0.33","@graphql-tools/relay-operation-optimizer@7.1.6","@graphql-tools/node-require@7.0.41","@graphql-tools/module-loader@8.0.30","@graphql-tools/mock@9.1.9","@graphql-tools/merge@9.1.11","@graphql-tools/load@8.1.12","@graphql-tools/links@10.0.10","@graphql-tools/json-file-loader@8.0.30","@graphql-tools/import@7.1.16","@graphql-tools/graphql-tag-pluck@8.3.33","@graphql-tools/graphql-file-loader@8.1.16","@graphql-tools/github-loader@9.1.4","@graphql-tools/git-loader@8.0.38","@graphql-tools/executor@1.5.5","@graphql-tools/executor-yoga@3.0.40","@graphql-tools/executor-urql-exchange@1.0.32","@graphql-tools/executor-legacy-ws@1.1.30","@graphql-tools/executor-envelop@4.0.10","@graphql-tools/executor-apollo-link@2.0.10","@graphql-tools/code-file-loader@8.1.34","@graphql-tools/apollo-engine-loader@8.0.32","release-1782659362754","graphql-tools@9.0.29","@graphql-tools/utils@11.1.1","@graphql-tools/url-loader@9.1.3","@graphql-tools/schema@10.0.34","@graphql-tools/resolvers-composition@7.0.32","@graphql-tools/relay-operation-optimizer@7.1.5","@graphql-tools/node-require@7.0.40","@graphql-tools/module-loader@8.0.29","@graphql-tools/mock@9.1.8","@graphql-tools/merge@9.1.10","@graphql-tools/load@8.1.11","@graphql-tools/links@10.0.9","@graphql-tools/json-file-loader@8.0.29","@graphql-tools/import@7.1.15","@graphql-tools/graphql-tag-pluck@8.3.32","@graphql-tools/graphql-file-loader@8.1.15","@graphql-tools/github-loader@9.1.3","@graphql-tools/git-loader@8.0.37","@graphql-tools/executor@1.5.4","@graphql-tools/executor-yoga@3.0.39","@graphql-tools/executor-urql-exchange@1.0.31","@graphql-tools/executor-legacy-ws@1.1.29","@graphql-tools/executor-envelop@4.0.9","@graphql-tools/executor-apollo-link@2.0.9","@graphql-tools/code-file-loader@8.1.33","@graphql-tools/apollo-engine-loader@8.0.31","release-1776944279203","graphql-tools@9.0.28","@graphql-tools/utils@11.1.0","@graphql-tools/url-loader@9.1.2","@graphql-tools/schema@10.0.33","@graphql-tools/resolvers-composition@7.0.31","@graphql-tools/relay-operation-optimizer@7.1.4","@graphql-tools/node-require@7.0.39","@graphql-tools/module-loader@8.0.28","@graphql-tools/mock@9.1.7","@graphql-tools/merge@9.1.9","@graphql-tools/load@8.1.10","@graphql-tools/links@10.0.8","@graphql-tools/json-file-loader@8.0.28","@graphql-tools/import@7.1.14","@graphql-tools/graphql-tag-pluck@8.3.31","@graphql-tools/graphql-file-loader@8.1.14","@graphql-tools/github-loader@9.1.2","@graphql-tools/git-loader@8.0.36","@graphql-tools/executor@1.5.3","@graphql-tools/executor-yoga@3.0.38","@graphql-tools/executor-urql-exchange@1.0.30","@graphql-tools/executor-legacy-ws@1.1.28","@graphql-tools/executor-envelop@4.0.8","@graphql-tools/executor-apollo-link@2.0.8","@graphql-tools/code-file-loader@8.1.32","@graphql-tools/apollo-engine-loader@8.0.30","release-1775728135704","graphql-tools@9.0.27","@graphql-tools/utils@11.0.1","@graphql-tools/url-loader@9.1.1","@graphql-tools/schema@10.0.32","@graphql-tools/resolvers-composition@7.0.30","@graphql-tools/relay-operation-optimizer@7.1.3","@graphql-tools/node-require@7.0.38","@graphql-tools/module-loader@8.0.27","@graphql-tools/mock@9.1.6","@graphql-tools/merge@9.1.8","@graphql-tools/load@8.1.9","@graphql-tools/links@10.0.7","@graphql-tools/json-file-loader@8.0.27","@graphql-tools/import@7.1.13","@graphql-tools/graphql-tag-pluck@8.3.30","@graphql-tools/graphql-file-loader@8.1.13","@graphql-tools/github-loader@9.1.1","@graphql-tools/git-loader@8.0.35","@graphql-tools/executor@1.5.2","@graphql-tools/executor-yoga@3.0.37","@graphql-tools/executor-urql-exchange@1.0.29","@graphql-tools/executor-legacy-ws@1.1.27","@graphql-tools/executor-envelop@4.0.7","@graphql-tools/executor-apollo-link@2.0.7","@graphql-tools/code-file-loader@8.1.31","@graphql-tools/apollo-engine-loader@8.0.29","release-1775215751665","@graphql-tools/url-loader@9.1.0","@graphql-tools/resolvers-composition@7.0.29","@graphql-tools/relay-operation-optimizer@7.1.2","@graphql-tools/graphql-tag-pluck@8.3.29","@graphql-tools/github-loader@9.1.0","@graphql-tools/git-loader@8.0.34","@graphql-tools/executor-legacy-ws@1.1.26","@graphql-tools/code-file-loader@8.1.30","@ardatan/relay-compiler@13.0.1","release-1772806937546","@graphql-tools/node-require@7.0.37","@graphql-tools/import@7.1.12","@graphql-tools/graphql-file-loader@8.1.12","release-1772725596254","@graphql-tools/relay-operation-optimizer@7.1.1","@ardatan/relay-compiler@13.0.0","release-1772723897561","@graphql-tools/resolvers-composition@7.0.28","@graphql-tools/relay-operation-optimizer@7.1.0","@graphql-tools/node-require@7.0.36","@graphql-tools/import@7.1.11","@graphql-tools/graphql-file-loader@8.1.11","@ardatan/relay-compiler@12.3.0","release-1767748441422","graphql-tools@9.0.26","@graphql-tools/utils@11.0.0","@graphql-tools/url-loader@9.0.6","@graphql-tools/schema@10.0.31","@graphql-tools/resolvers-composition@7.0.26","@graphql-tools/relay-operation-optimizer@7.0.27","@graphql-tools/node-require@7.0.34","@graphql-tools/module-loader@8.0.26","@graphql-tools/mock@9.1.5","@graphql-tools/merge@9.1.7","@graphql-tools/load@8.1.8","@graphql-tools/links@10.0.6","@graphql-tools/json-file-loader@8.0.26","@graphql-tools/import@7.1.9","@graphql-tools/graphql-tag-pluck@8.3.27","@graphql-tools/graphql-file-loader@8.1.9","@graphql-tools/github-loader@9.0.6","@graphql-tools/git-loader@8.0.32","@graphql-tools/executor@1.5.1","@graphql-tools/executor-yoga@3.0.36","@graphql-tools/executor-urql-exchange@1.0.28","@graphql-tools/executor-legacy-ws@1.1.25","@graphql-tools/executor-envelop@4.0.6","@graphql-tools/executor-apollo-link@2.0.6","@graphql-tools/code-file-loader@8.1.28","@graphql-tools/apollo-engine-loader@8.0.28","release-1764324313752","graphql-tools@9.0.25","@graphql-tools/utils@10.11.0","@graphql-tools/url-loader@9.0.5","@graphql-tools/schema@10.0.30","@graphql-tools/resolvers-composition@7.0.25","@graphql-tools/relay-operation-optimizer@7.0.26","@graphql-tools/node-require@7.0.33","@graphql-tools/module-loader@8.0.25","@graphql-tools/mock@9.1.4","@graphql-tools/merge@9.1.6","@graphql-tools/load@8.1.7","@graphql-tools/links@10.0.5","@graphql-tools/json-file-loader@8.0.25","@graphql-tools/import@7.1.8","@graphql-tools/graphql-tag-pluck@8.3.26","@graphql-tools/graphql-file-loader@8.1.8","@graphql-tools/github-loader@9.0.5","@graphql-tools/git-loader@8.0.31","@graphql-tools/executor@1.5.0","@graphql-tools/executor-yoga@3.0.35","@graphql-tools/executor-urql-exchange@1.0.27","@graphql-tools/executor-legacy-ws@1.1.24","@graphql-tools/executor-envelop@4.0.5","@graphql-tools/executor-apollo-link@2.0.5","@graphql-tools/code-file-loader@8.1.27","@graphql-tools/apollo-engine-loader@8.0.27","release-1763693142685","@graphql-tools/node-require@7.0.32","@graphql-tools/import@7.1.7","@graphql-tools/graphql-file-loader@8.1.7","release-1762942062826","graphql-tools@9.0.24","@graphql-tools/utils@10.10.3","@graphql-tools/url-loader@9.0.4","@graphql-tools/schema@10.0.29","@graphql-tools/resolvers-composition@7.0.24","@graphql-tools/relay-operation-optimizer@7.0.25","@graphql-tools/node-require@7.0.31","@graphql-tools/module-loader@8.0.24","@graphql-tools/mock@9.1.3","@graphql-tools/merge@9.1.5","@graphql-tools/load@8.1.6","@graphql-tools/links@10.0.4","@graphql-tools/json-file-loader@8.0.24","@graphql-tools/import@7.1.6","@graphql-tools/graphql-tag-pluck@8.3.25","@graphql-tools/graphql-file-loader@8.1.6","@graphql-tools/github-loader@9.0.4","@graphql-tools/git-loader@8.0.30","@graphql-tools/executor@1.4.13","@graphql-tools/executor-yoga@3.0.34","@graphql-tools/executor-urql-exchange@1.0.26","@graphql-tools/executor-legacy-ws@1.1.23","@graphql-tools/executor-envelop@4.0.4","@graphql-tools/executor-apollo-link@2.0.4","@graphql-tools/code-file-loader@8.1.26","@graphql-tools/apollo-engine-loader@8.0.26","release-1762898070675","graphql-tools@9.0.23","@graphql-tools/utils@10.10.2","@graphql-tools/url-loader@9.0.3","@graphql-tools/schema@10.0.28","@graphql-tools/resolvers-composition@7.0.23","@graphql-tools/relay-operation-optimizer@7.0.24","@graphql-tools/node-require@7.0.30","@graphql-tools/module-loader@8.0.23","@graphql-tools/mock@9.1.2","@graphql-tools/merge@9.1.4","@graphql-tools/load@8.1.5","@graphql-tools/links@10.0.3","@graphql-tools/json-file-loader@8.0.23","@graphql-tools/import@7.1.5","@graphql-tools/graphql-tag-pluck@8.3.24","@graphql-tools/graphql-file-loader@8.1.5","@graphql-tools/github-loader@9.0.3","@graphql-tools/git-loader@8.0.29","@graphql-tools/executor@1.4.12","@graphql-tools/executor-yoga@3.0.33","@graphql-tools/executor-urql-exchange@1.0.25","@graphql-tools/executor-legacy-ws@1.1.22","@graphql-tools/executor-envelop@4.0.3","@graphql-tools/executor-apollo-link@2.0.3","@graphql-tools/code-file-loader@8.1.25","@graphql-tools/apollo-engine-loader@8.0.25","release-1762270964217","graphql-tools@9.0.22","@graphql-tools/utils@10.10.1","@graphql-tools/url-loader@9.0.2","@graphql-tools/schema@10.0.27","@graphql-tools/resolvers-composition@7.0.22","@graphql-tools/relay-operation-optimizer@7.0.23","@graphql-tools/node-require@7.0.29","@graphql-tools/module-loader@8.0.22","@graphql-tools/mock@9.1.1","@graphql-tools/merge@9.1.3","@graphql-tools/load@8.1.4","@graphql-tools/links@10.0.2","@graphql-tools/json-file-loader@8.0.22","@graphql-tools/import@7.1.4","@graphql-tools/graphql-tag-pluck@8.3.23","@graphql-tools/graphql-file-loader@8.1.4","@graphql-tools/github-loader@9.0.2","@graphql-tools/git-loader@8.0.28","@graphql-tools/executor@1.4.11","@graphql-tools/executor-yoga@3.0.32","@graphql-tools/executor-urql-exchange@1.0.24","@graphql-tools/executor-legacy-ws@1.1.21","@graphql-tools/executor-envelop@4.0.2","@graphql-tools/executor-apollo-link@2.0.2","@graphql-tools/code-file-loader@8.1.24","@graphql-tools/apollo-engine-loader@8.0.24"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-114604.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N"}]}