CVE-2026-114604

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. From 10.10.1 until 12.0.2, the @graphql-tools/utils mergeIncrementalResult helper passes incrementalResult.path segments to setObjectKeyPath without runtime primitive-type validation. A non-primitive segment can bypass strict comparisons against __proto__, constructor, and prototype, then be coerced during property access so a malicious or compromised upstream incremental GraphQL response writes attacker-controlled properties to Object.prototype in the consuming Node.js process. The affected implementation is packages/utils/src/mergeIncrementalResult.ts and is reachable when consumers merge untrusted @defer or @stream transport results. This issue is fixed in version 12.0.2.

• CWE-1321

• https://github.com/ardatan/graphql-tools/commit/19f5b3373fd7ace0688d19950fc529ce8347952a
• https://github.com/ardatan/graphql-tools/commit/20d36a5c6eb8fd5524420988e01a48618c450d70
• https://github.com/ardatan/graphql-tools/pull/8467
• https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/utils@12.0.2
• https://github.com/ardatan/graphql-tools/security/advisories/GHSA-c4qx-w738-7hr3

Published

Nov 5, 2026

Last Modified

Nov 5, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-114596In EPICS Base release 7.0.10 and prior, an improper validati…8.2
• CVE-2026-114597In EPICS Base release 7.0.10 and prior, an insufficient vali…7.5
• CVE-2026-114598In EPICS Base release 7.0.10 and prior, an insufficient vali…7.5
• CVE-2026-1146A vulnerability has been found in SourceCodester/Patrick Mvu…5.4
• CVE-2026-11460A flaw has been found in Boost Serialization. The impacted e…7.3
• CVE-2026-114603OpenTelemetry Python provides the Python API and SDK for Ope…5.3
• CVE-2026-114605dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.n…7.5
• CVE-2026-114606draw.io Desktop is the official Electron build of draw.io. P…5.6
• CVE-2026-114607Better Auth is an authentication and authorization library f…9.1
• CVE-2026-114608Pylint is a static code analyser for Python. From 0.15.2 unt…5.4
• CVE-2026-114609fpdf2 is a PDF creation library for Python. Prior to 2.8.8, …5.8
• CVE-2026-11461A vulnerability has been found in NousResearch hermes-agent …6.3