CVE-2026-23897 json
Apollo Server is vulnerable to denial of service with `startStandaloneServer`
published 9mo ago modified 4mo ago also GHSA-mp6q-xf9x-fwf7 , EUVD-2026-5364
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 53%
- public exploits
- 0
- none known
Summary
Apollo Server is an open-source, spec-compliant GraphQL server that's compatible with any GraphQL client, including Apollo Client. In versions from 2.0.0 to 3.13.0, 4.2.0 to before 4.13.0, and 5.0.0 to before 5.4.0, the default configuration of startStandaloneServer from @apollo/server/standalone is vulnerable to denial of service (DoS) attacks through specially crafted request bodies with exotic character set encodings. This issue does not affect users that use @apollo/server as a dependency for integration packages, like @as-integrations/express5 or @as-integrations/next, only direct usage of startStandaloneServer.
Patch / fix
- npm @apollo/server 4.13.0, 5.4.0
- apollographql apollo_server 4.13.0, 5.4.0
Is CVE-2026-23897 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 9mo ago
Exploit prediction
0.69% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | apollo-server | >=2.0.0, <=3.13.0 |
no fix listed |
| npm | @apollo/server | >=4.2.0, <4.13.0 >=5.0.0, <5.4.0 |
4.13.0 5.4.0 |
Affected products
- apollographql apollo-server
Classification
- Weakness
-
- CWE-1333 Inefficient Regular Expression Complexity
References
-
github.com
/apollographql/apollo-server/commit/d25a5bdc377826ad424fcf7f8d1d062055911643
web, patch
-
github.com
/apollographql/apollo-server/commit/e9d49d163a86b8a33be56ed27c494b9acd5400a4
web, patch
-
github.com
/apollographql/apollo-server/security/advisories/GHSA-mp6q-xf9x-fwf7
web, mitigation, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-23897
advisory
-
github.com
/apollographql/apollo-server
package
Sources
- CVE List CVE-2026-23897
- GitHub Advisory GHSA-mp6q-xf9x-fwf7
- NVD CVE-2026-23897
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.