@graphql-tools/utils: Prototype pollution in mergeIncrementalResult lets a malicious upstream GraphQL response write to Object.prototype (CVE-2026-114604)
Severity: high · Patch status: patched · Since 2026-09-30 · CVE-2026-114604
A prototype pollution flaw in @graphql-tools/utils' public mergeIncrementalResult/setObjectKeyPath helper (CVE-2026-114604) affects versions 10.10.1 through 12.0.1, introduced when the dset dependency was removed. The forbidden-key guard compares path segments with strict equality, but a non-primitive segment such as the array ["proto"] passes the check and is then coerced to the string key "proto", letting an attacker-controlled incremental (@defer/@stream) GraphQL response from an untrusted upstream assign arbitrary properties to Object.prototype in the consuming Node.js gateway or client process. This can alter authorization and configuration checks on objects created later. A public PoC sets Object.prototype.isAdmin and defeats fresh-object checks. Fixed in 12.0.2; 10.10.0 and earlier (dset-based) are not affected.
What to do
- Upgrade @graphql-tools/utils to 12.0.2 or later anywhere it is used to merge incremental results from upstream GraphQL servers
- If upgrading is not immediately possible, pin/downgrade to 10.10.0 or earlier, or freeze Object.prototype in the affected Node.js process
- Audit whether your gateway/client merges incremental payloads from upstreams you do not control, and runtime-validate that incremental path segments are primitive strings or numbers before calling mergeIncrementalResult
- Review code relying on inherited object defaults (e.g. opts.isAdmin === true checks) for potential impact if pollution occurred
Fixed versions
- @graphql-tools/utils 12.0.2
Sources
All live incidents on Threat Watch
