@apollo/server
5.5.1 · 5 May 2026MIT1.7M / weekRepositoryHomepagenpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for @apollo/server. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 5.5.1 | Safe from 5.5.0 | |
| 4.13.0 | 1 open advisory, worst moderate |
- HighApollo Serve vulnerable to Denial of Service with `startStandaloneServer`GHSA-mp6q-xf9x-fwf7 · 4 Feb 2026
- 5.x5.0.0 – 5.3.0Fixed in 5.4.0
- 4.x4.2.0 – 4.12.2Fixed in 4.13.0
- ModerateApollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) preventionGHSA-9q82-xgwf-vj6h · 26 Mar 2026
- 5.x5.0.0 – 5.4.0Fixed in 5.5.0
- 4.x4.0.0 – 4.13.0No fix on 4.x · move to 5.5.0
- ModerateBatched HTTP requests may set incorrect `cache-control` response headerGHSA-8r69-3cvp-wxc3 · 2 Nov 2022
- 4.x4.0.0 – 4.0.5Fixed in 4.1.0
- LowPrevent logging invalid header valuesGHSA-j5g3-5c8r-7qfx · 30 Aug 2023
- 4.x4.0.0 – 4.9.2Fixed in 4.9.3
- Low@apollo/server vulnerable to unsafe application of Content Security Policy via reused noncesGHSA-68jh-rf6x-836f · 16 Jun 2023
- 4.x4.7.1 – 4.7.3Fixed in 4.7.4
Registry facts last checked 24 Oct 2026. Releases and advisories last read 24 Oct 2026.