@graphql-tools/utils patches CVE-2026-114604 prototype pollution vulnerability in version 12.0.2

A high severity vulnerability in the @graphql-tools/utils npm package allows for prototype pollution via unvalidated object path traversal. The flaw, identified as CVE-2026-114604, exists in versions 10.10.1 through 12.0.1 and has been resolved in version 12.0.2.

What happened

The vulnerability resides in the mergeIncrementalResult function within the @graphql-tools/utils package. This component merges incremental GraphQL response parts into accumulated execution results by walking a specific data path. According to the GitHub advisory GHSA-c4qx-w738-7hr3, the issue was introduced by commit fbb58b51c4993ba9680ce6c2ef7203ab3a142713, which removed the dset dependency.

The core problem lies in the setObjectKeyPath helper function. It attempts to reject dangerous path segments by checking for strict string equality against __proto__, constructor, and prototype. However, it fails to validate that a path segment is actually a primitive string or number. This oversight allows attackers to bypass the safety checks.

An attacker can supply a JSON path segment formatted as an array, such as ["__proto__"]. Because the array object is not strictly equal to the string __proto__, the guard condition passes. The subsequent code then coerces the array into a string key via ToPropertyKey coercion. This resolves to Object.prototype, allowing the next segment to be assigned directly to the global prototype.

This behavior occurs in the default configuration with no additional options required. The advisory notes that the flaw affects public, documented exports. It was verified against source code and published npm builds including 10.10.0, 10.10.1, 11.0.0, 12.0.0, and 12.0.1. Version 10.10.0 is not affected.

Why it matters

Prototype pollution vulnerabilities can have severe consequences for application security. By modifying the prototype of an object, attackers can inject properties into all objects created from that prototype. This can lead to privilege escalation, denial of service, or remote code execution depending on how the application uses the polluted properties.

The @graphql-tools/utils package is widely used in GraphQL implementations. Many applications rely on this library for handling incremental results from @defer or @stream directives. Because the vulnerability is present in the default configuration, any application using the affected versions is potentially exposed without additional hardening measures.

The flaw was introduced when the dset dependency was removed. The new implementation did not account for type coercion differences between primitive strings and array objects. This highlights the risks of changing core utility functions without comprehensive regression testing for security implications.

Our take on the response

The vendor has addressed the issue by releasing version 12.0.2. This update patches the prototype pollution vulnerability. Users of the affected package should update to this version as soon as possible. The advisory provides clear details on the affected versions and the nature of the fix.

What defenders should look for

Security teams should monitor for unusual object prototype modifications in their GraphQL applications. Look for unexpected properties appearing on standard objects or errors related to object coercion. Check server logs for suspicious input patterns in GraphQL queries, particularly those involving nested arrays or unusual path structures. Investigate any instances where application behavior changes unexpectedly after processing incremental results.

What to do and how to stay safe: @graphql-tools/utils

• Audit your npm dependencies to identify if you are using @graphql-tools/utils versions 10.10.1 through 12.0.1.
• Update to version 12.0.2 or later to apply the patch for CVE-2026-114604.
• Review your GraphQL schema and resolvers for any custom logic that might be affected by prototype pollution.
• Implement input validation for all GraphQL queries to reject unexpected data types or structures.

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-114604?

It is a high severity prototype pollution vulnerability in @graphql-tools/utils that allows bypassing path validation checks.

Which versions of @graphql-tools/utils are affected?

Versions 10.10.1 through 12.0.1 are affected by this vulnerability.

How was the vulnerability fixed?

The vendor released version 12.0.2, which addresses the path traversal vulnerability.