Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@graphql-tools/utils

2 known vulnerabilities (2 high), with the versions each affects and the releases that fix them.

Latest release
13.2.1 (Oct 31, 2026): no advisory affects it
Newest unaffected release
13.2.1 (Oct 31, 2026), the latest release
Advisories
2 · 2 high
Weekly downloads
57.5M
Dependents
206
Releases
500+ since 10.10.0 (Oct 30, 2025)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-114604
    Affects 10.10.1 to 12.0.2-alpha-20260930213106-001ad6da4923b8bb612d81d5418e51f7365e603b (12.0.2 is outside it)
  • CVE-2026-104852
    Affects 10.10.0-alpha-20251017043554-c1f8f4b5e967333828766dc2eefb334879105453 to 12.0.1-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4 (12.0.1 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 2

  • GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

    Affected: from 10.10.1, fixed in 12.0.2.

    Fixed in 12.0.2 (released Sep 30, 2026, 36 days before disclosure).

    The latest release, 13.2.1, is not affected.

    36% of @graphql-tools/utils downloads last week were affected versions (23M).

  • GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

    Affected: fixed in 12.0.1.

    Fixed in 12.0.1 (released Sep 7, 2026, 28 days before disclosure).

    The latest release, 13.2.1, is not affected.

    75% of @graphql-tools/utils downloads last week were affected versions (47.7M).