@apollo/gateway
2.14.4 · 18 Aug 2026Elastic-2.0180.9k / weekRepositoryHomepagenpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for @apollo/gateway. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 2.14.4 | Safe from 2.13.2 | |
| 0.54.1 | 160 open advisories, worst critical · last release Nov 2022, no longer updated |
- CriticalApollo Federation vulnerable to prototype pollution via incomplete key sanitizationGHSA-pfjj-6f4p-rvmh · 13 Mar 2026
- 2.x2.0.0 – 2.13.1Fixed in 2.13.2
- 0.54.x and older0.1.0 – 0.54.1No fix, no longer updated · move to 2.13.2
- HighApollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Optimization BypassGHSA-p2q6-pwh5-m6jr · 7 Apr 2025
- 2.x2.0.0 – 2.10.0Fixed in 2.10.1
- 0.54.x and older0.1.0 – 0.54.1No fix, no longer updated · move to 2.10.1
- HighApollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment ExpansionGHSA-q2f9-x4p4-7xmh · 7 Apr 2025
- 2.x2.0.0 – 2.10.0Fixed in 2.10.1
- 0.54.x and older0.1.0 – 0.54.1No fix, no longer updated · move to 2.10.1
- HighApollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queriesGHSA-fmj9-77q8-g6c4 · 27 Aug 2024
- 2.x2.0.0 – 2.8.4Fixed in 2.8.5
- HighPrototype Pollution in @apollo/gatewayGHSA-74cr-77xc-8g6r · 13 Jun 2019
- 0.6.x0.6.0 – 0.6.1Fixed in 0.6.2
- 0.5.x and older0.1.0 – 0.5.0No fix, no longer updated · move to 0.6.2
Registry facts last checked 24 Oct 2026. Releases and advisories last read 24 Oct 2026.