# apollo-router (crates.io) vulnerabilities

12 known vulnerabilities (1 critical, 11 high), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Weekly downloads: 1,559
- Dependents: 0
- Registry: https://crates.io/crates/apollo-router

## Advisories (12)

### [CVE-2025-64347](https://cve.now/CVE-2025-64347): Apollo Router Improperly Enforces Renamed Access Control Directives

- Severity: High 7.5
- Published: Nov 7, 2025
- Affected: fixed in 1.61.12; from 2.0.0-alpha.0, fixed in 2.8.1.

### [CVE-2025-64173](https://cve.now/CVE-2025-64173): Apollo Router Core: Access Control Bypass on Polymorphic Types

- Severity: High 7.5
- Published: Nov 6, 2025
- Affected: fixed in 1.61.12; from 2.0.0-alpha.0, fixed in 2.8.1.

### [CVE-2025-32380](https://cve.now/CVE-2025-32380): Apollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processing

- Severity: High 7.5
- Published: Apr 9, 2025
- Affected: fixed in 1.61.2; from 2.0.0-alpha.0, fixed in 2.1.1.

### [CVE-2025-32034](https://cve.now/CVE-2025-32034): Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion

- Severity: High 7.5
- Published: Apr 7, 2025
- Affected: fixed in 1.61.2; from 2.0.0-alpha.0, fixed in 2.1.1.

### [CVE-2025-32033](https://cve.now/CVE-2025-32033): Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow

- Severity: High 7.5
- Published: Apr 7, 2025
- Affected: fixed in 1.61.2; from 2.0.0-alpha.0, fixed in 2.1.1.

### [CVE-2025-32032](https://cve.now/CVE-2025-32032): Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass

- Severity: High 7.5
- Published: Apr 7, 2025
- Affected: fixed in 1.61.2; from 2.0.0-alpha.0, fixed in 2.1.1.

### [CVE-2024-43414](https://cve.now/CVE-2024-43414): Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries

- Severity: High 7.5
- Published: Aug 27, 2024
- Affected: fixed in 1.52.1.

### [CVE-2024-43783](https://cve.now/CVE-2024-43783): Apollo Router Coprocessors may cause Denial-of-Service when handling request bodies

- Severity: High 7.5
- Published: Aug 27, 2024
- Affected: from 1.7.0, fixed in 1.52.1.

### [CVE-2024-32971](https://cve.now/CVE-2024-32971): Defect in query plan cache may cause incorrect operations to be executed in Apollo Router

- Severity: Critical 9.1
- Published: May 2, 2024
- Affected: from 1.44.0, fixed in 1.45.1.

### [CVE-2024-28101](https://cve.now/CVE-2024-28101): Apollo Router's Compressed Payloads do not respect HTTP Payload Limits

- Severity: High 7.5
- Published: Mar 6, 2024
- Affected: from 0.9.5, fixed in 1.40.2.

### [CVE-2023-45812](https://cve.now/CVE-2023-45812): Improper Check or Handling of Exceptional Conditions in apollo-router

- Severity: High 7.5
- Published: Oct 18, 2023
- Affected: from 1.31.0, fixed in 1.33.0.

### [CVE-2023-41317](https://cve.now/CVE-2023-41317): Unnamed "Subscription" operation results in Denial-of-Service in apollographql/router

- Severity: High 7.5
- Published: Sep 5, 2023
- Affected: from 1.28.0, fixed in 1.29.1.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/crates.io/apollo-router
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.