CVE-2024-23841

apollo-client-nextjs is the Apollo Client support for the Next.js App Router. The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this vulnerability, an attacker would need to either inject malicious input (e.g. by redirecting a user to a specifically-crafted link) or arrange to have malicious input be returned by a GraphQL server (e.g. by persisting it in a database). To fix this issue, please update to version 0.7.0 or later.

• CWE-80

• https://github.com/apollographql/apollo-client-nextjs/commit/b92bc42abd5f8e17d4db361c36bd08e4f541a46bPatch
• https://github.com/apollographql/apollo-client-nextjs/security/advisories/GHSA-rv8p-rr2h-fgpgVendor Advisory
• https://github.com/apollographql/apollo-client-nextjs/commit/b92bc42abd5f8e17d4db361c36bd08e4f541a46bPatch
• https://github.com/apollographql/apollo-client-nextjs/security/advisories/GHSA-rv8p-rr2h-fgpgVendor Advisory

Published

Jan 30, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-23836Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2024-23837LibHTP is a security-aware parser for the HTTP protocol. Cra…7.5
• CVE-2024-23838TrueLayer.NET is the .Net client for TrueLayer. The vulnera…7.5
• CVE-2024-23839Suricata is a network Intrusion Detection System, Intrusion …8.1
• CVE-2024-2384The WooCommerce POS plugin for WordPress is vulnerable to in…4.3
• CVE-2024-23840GoReleaser builds Go binaries for several platforms, creates…5.5
• CVE-2024-23842Improper Input Validation in Hitron Systems DVR LGUVR-16H 1.…7.5
• CVE-2024-23843Improper Neutralization of Special Elements used in an SQL C…2.2
• CVE-2024-23847Incorrect default permissions issue exists in Unifier and Un…5.9
• CVE-2024-23848In the Linux kernel through 6.7.1, there is a use-after-free…5.5
• CVE-2024-23849In rds_recv_track_latency in net/rds/af_rds.c in the Linux k…5.5
• CVE-2024-2385The Elementor Addons by Livemesh plugin for WordPress is vul…8.8