fix(deps): update dependency @apollo/server to v5.5.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@apollo/server (source)	5.2.0 → 5.5.0

---

Apollo Serve vulnerable to Denial of Service with startStandaloneServer

CVE-2026-23897 / GHSA-mp6q-xf9x-fwf7

More information

Details

Impact

The default configuration of startStandaloneServer from @apollo/server/standalone is vulnerable to Denial of Service (DoS) attacks through specially crafted request bodies with exotic character set encodings.

This issue does not affect users that use @apollo/server as a dependency for integration packages, like @as integrations/express5 or @as-integrations/next, only direct usage of startStandaloneServer.

Who is impacted

Users directly using startStandaloneServer from @apollo/server/standalone.

This issue affects Apollo Server from v5.0.0 through v5.3.x.

It also affects all releases of the end-of-life major versions v4, v3, and v2. Although Apollo Server v4 is EOL and Apollo no longer commits to providing support or updates for it, a fix for it was released in v4.13.0. Apollo Server v3 and v2 are no longer updated, as they have been EOL since 2024 and 2023 respectively.

Patches

Patches for this issue are released as @apollo/server versions 5.4.0 and 4.13.0.

In accordance with RFC 7159, these versions now only accept request bodies encoded in UTF-8, UTF-16 (LE or BE), or UTF-32 (LE or BE). Any other character set will be rejected with a 415 Unsupported Media Type error. Note that the more recent JSON RFC, [RFC 8259 (https://datatracker.ietf.org/doc/html/rfc8259#section-8.1), is more strict and will only allow UTF-8. Since this is a minor release, we have chosen to remain compatible with the more permissive RFC 7159 for now. In a future major release, the restriction may be tightened further to only allow UTF-8.

Workarounds

Users of apollo-server v2 or v3 that cannot upgrade for some reason could switch from the standalone apollo-server
package to an integration package like apollo-server-express or apollo-server-koa and set up their own server. Please note that these old packages are generally EOL and do not receive any more support or bug fixes. This can only be seen as a short-term workaround. Updating to @apollo/server v5 should be a priority.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/apollographql/apollo-server/security/advisories/GHSA-mp6q-xf9x-fwf7
• https://github.com/apollographql/apollo-server/commit/d25a5bdc377826ad424fcf7f8d1d062055911643
• https://github.com/apollographql/apollo-server/commit/e9d49d163a86b8a33be56ed27c494b9acd5400a4
• https://nvd.nist.gov/vuln/detail/CVE-2026-23897
• https://github.com/advisories/GHSA-mp6q-xf9x-fwf7

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Apollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention

GHSA-9q82-xgwf-vj6h

More information

Details

Impact

In a Cross-Site Request Forgery attack, untrusted web content causes browsers to send authenticated requests to web servers which use cookies for authentication. While the web content is prevented from reading the request's response due to the Cross-Origin Request Sharing (CORS) protocol, an attacker may be able to cause side effects in the server ("CSRF" attack), or learn something about the response via timing analysis ("XS-Search" attack).

Apollo Server has a built-in feature which prevents CSRF and XS-Search attacks: it refuses to process GraphQL requests that could possibly have been sent by a spec-compliant web browser without a protective "preflight" step. See Apollo Server's docs for more details on CORS, CSRF attacks, and Apollo Server's CSRF prevention feature.

This feature is fully effective against attacks carried out against users of spec-compliant browsers. Unfortunately, a major browser introduced a bug in 2025 which meant in certain cases, it failed to follow the CORS spec. The browser's maintainers have already committed to fixing the bug and making the browser spec-compliant again.

Even with this bug, Apollo Server's CSRF prevention feature blocks "side effect" CSRF attacks: Apollo Server will still correctly refuse to execute mutations in requests that were not preflighted. However, some specially crafted authenticated GraphQL queries can be issued across origins without preflight in buggy versions of this browser, allowing for XS-Search attacks: an attacker can analyze response times to learn facts about the responses to requests such as whether fields return null or approximately how many list entries are returned from fields.

GraphQL servers are only vulnerable if they rely on cookies (or HTTP Basic Auth) for authentication.

Patches

The vulnerability is patched in @apollo/server v5.5.0. This release contains a single change: GraphQL requests sent in HTTP GET requests which contain a Content-Type header naming a type other than application/json are rejected. (GET requests with no Content-Type are allowed.) This change prevents XS-Search attacks even in browsers which are non-compliant in ways similar to this browser.

There are no known cases where GraphQL apps depend on the ability of clients to send non-empty Content-Type headers with GET requests other than application/json, so this change has not been made configurable; if this change breaks a use case, file an issue and more configurability can be added.

Apollo is not currently providing a patch for previous major versions of Apollo Server, which are all end-of-life.

Workarounds

If upgrading is not possible, this particular browser's bug can be mitigated by preventing any HTTP request with a Content-Type header containing message/ from reaching Apollo Server (e.g. in a proxy or middleware).

For example, when using Apollo Server's Express integration, something like this can be placed before attaching expressMiddleware to the app:

app.use((req, res, next) => {
  for (let i = 0; i < req.rawHeaders.length - 1; i += 2) {
    if (
      req.rawHeaders[i].toLowerCase() === 'content-type' &&
      req.rawHeaders[i + 1].includes('message/')
    ) {
      return res.status(415).json({ error: 'Content-Type not allowed' });
    }
  }
  next();
});

While the patch prevents a broader class of similar issues, the only known way to exploit this vulnerability is against a particular browser which currently plans to ship a fix in May 2026. If it is already past June 2026 and this vulnerability has not been addressed yet, it is likely that the system is not currently vulnerable. Upgrading to the latest version of Apollo Server is still recommended for the broader protection.

Resources

The browser bug causes a similar vulnerability in Apollo Router; see GHSA-hff2-gcpx-8f4p

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

References

• https://github.com/apollographql/apollo-server/security/advisories/GHSA-9q82-xgwf-vj6h
• https://github.com/apollographql/router/security/advisories/GHSA-hff2-gcpx-8f4p
• https://github.com/apollographql/apollo-server/commit/ada12001c4e95b5c779d80314a5a32e33087b5cf
• https://github.com/apollographql/apollo-server/releases/tag/@​apollo/server@5.5.0
• https://www.apollographql.com/docs/apollo-server/previous-versions
• https://github.com/advisories/GHSA-9q82-xgwf-vj6h

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

apollographql/apollo-server (@​apollo/server)

v5.5.0

Compare Source

Minor Changes

• #​8191 ada1200 Thanks @​glasser! - ⚠️ SECURITY @apollo/server/standalone:

  Apollo Server now rejects GraphQL GET requests which contain a Content-Type header other than application/json (with optional parameters such as ; charset=utf-8). Any other value is now rejected with a 415 status code.

  (GraphQL GET requests without a Content-Type header are still allowed, though they do still need to contain a non-empty X-Apollo-Operation-Name or Apollo-Require-Preflight header to be processed if the default CSRF prevention feature is enabled.)

  This improvement makes Apollo Server's CSRF more resistant to browsers which implement CORS in non-spec-compliant ways. Apollo is aware of one browser which as of March 2026 has a bug which allows an attacker to circumvent Apollo Server's CSRF prevention feature to carry out read-only XS-Search-style CSRF attacks. The browser vendor is in the process of patching this vulnerability; upgrading Apollo Server to v5.5.0 mitigates this vulnerability.

  If your server uses cookies (or HTTP Basic Auth) for authentication, Apollo encourages you to upgrade to v5.5.0.

  This is technically a backwards-incompatible change. Apollo is not aware of any GraphQL clients which provide non-empty Content-Type headers with GET requests with types other than application/json. If your use case requires such requests, please file an issue and we may add more configurability in a follow-up release.

  See advisory GHSA-9q82-xgwf-vj6h for more details.

v5.4.0

Compare Source

Minor Changes

• d25a5bd Thanks @​phryneas! - ⚠️ SECURITY @apollo/server/standalone:

  The default configuration of startStandaloneServer was vulnerable to denial of service (DoS) attacks through specially crafted request bodies with exotic character set encodings.

  In accordance with RFC 7159, we now only accept request bodies encoded in UTF-8, UTF-16 (LE or BE), or UTF-32 (LE or BE).
  Any other character set will be rejected with a 415 Unsupported Media Type error.
  Note that the more recent JSON RFC, RFC 8259, is more strict and will only allow UTF-8.
  Since this is a minor release, we have chosen to remain compatible with the more permissive RFC 7159 for now.
  In a future major release, we may tighten this restriction further to only allow UTF-8.

  If you were not using startStandaloneServer, you were not affected by this vulnerability.

  Generally, please note that we provide startStandaloneServer as a convenience tool for quickly getting started with Apollo Server.
  For production deployments, we recommend using Apollo Server with a more fully-featured web server framework such as Express, Koa, or Fastify, where you have more control over security-related configuration options.

v5.3.0

Compare Source

Minor Changes

• #​8062 8e54e58 Thanks @​cristunaranjo! - Allow configuration of graphql execution options (maxCoercionErrors)

  const server = new ApolloServer({
    typeDefs,
    resolvers,
    executionOptions: {
      maxCoercionErrors: 50,
    },
  });

• #​8014 26320bc Thanks @​mo4islona! - Expose graphql validation options.

  const server = new ApolloServer({
    typeDefs,
    resolvers,
    validationOptions: {
      maxErrors: 10,
    },
  });

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 333ee31

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.19%. Comparing base (c9a6abf) to head (333ee31).
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #850   +/-   ##
=======================================
  Coverage   92.19%   92.19%           
=======================================
  Files          17       17           
  Lines         397      397           
  Branches      128      128           
=======================================
  Hits          366      366           
  Misses         31       31           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.