CVE-2025-27097
Last modified
CVE-2025-27097 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. When a user transforms on the root level or single source with transforms, and the client sends the same query with different variables, the initial variables are used in all following requests until the cache evicts DocumentNode. EPSS estimates a 0.40% chance of exploitation in the next 30 days.
Description
GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. When a user transforms on the root level or single source with transforms, and the client sends the same query with different variables, the initial variables are used in all following requests until the cache evicts DocumentNode. If a token is sent via variables, the following requests will act like the same token is sent even if the following requests have different tokens. This can cause a short memory leak but it won't grow per each request but per different operation until the cache evicts DocumentNode by LRU mechanism.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| The-Guild | Graphql Mesh | 0.96.5 |
| The-Guild | Graphql Mesh | 0.96.6 |
| The-Guild | Graphql Mesh | 0.96.7 |
| The-Guild | Graphql Mesh | 0.96.8 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-27097?
How severe is CVE-2025-27097?
How do I fix CVE-2025-27097?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-27091OpenH264 is a free license codec library which supports H.26…7.5
- CVE-2025-27092GHOSTS is an open source user simulation framework for cyber…7.5
- CVE-2025-27093Sliver is a command and control framework that uses a custom…6.3
- CVE-2025-27094Tuleap is an open-source suite designed to improve software …5.4
- CVE-2025-27095JumpServer is an open source bastion host and an operation a…4.3
- CVE-2025-27096WeGIA is a Web Manager for Institutions with a focus on Port…9.8
- CVE-2025-27098GraphQL Mesh is a GraphQL Federation framework and gateway f…7.5
- CVE-2025-27099Tuleap is an Open Source Suite to improve management of soft…4.8
- CVE-2025-2710A vulnerability was found in Yonyou UFIDA ERP-NC 5.0 and cla…6.1
- CVE-2025-27100lakeFS is an open-source tool that transforms your object st…6.5
- CVE-2025-27101Opal is OBiBa’s core database application for biobanks or ep…7.3
- CVE-2025-27102Agate is central authentication server software for OBiBa ep…5.4
Are you affected by CVE-2025-27097?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST