Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apollographql/apollo-server

              main @ cfbfe71
            

Fixes

CVEs

HIGH

Peak severity

58.8%

Coverage

Highlights

Denial of Service: 25 prior fixes. Scrutinize any change in this area.

packages/apollo-server-core/src/ApolloServer.ts: most-fixed (5 issues). Treat as high-risk during review.

12 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

CSRF: Attackers can exploit GET request execution of state-modifying operations using cookies or basic authentication. Standard mitigations require preflight enforcement and strict validation of Content-Type and custom headers.

Denial of Service: Unbounded in-memory caches used by default for APQ tracking lead to heap exhaustion under load when clients send arbitrary queries, necessitating bounded/LRU cache structures.

Auth Bypass: When using custom document stores and gateways, updated schemas could bypass validation due to missing cache key isolation, allowing stale/unauthorized operations to execute against newer schemas.