@graphql-tools/utils
13.1.3 · 22 Oct 2026MIT25.7M / weekRepositoryHomepagenpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for @graphql-tools/utils. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 13.1.3 | No known advisory | |
| 12.1.0 | Safe from 12.0.2 | |
| 11.2.2 | 2 open advisories, worst high | |
| 10.11.0 | 2 open advisories, worst high | |
| 9.2.1 | 4 open advisories, worst high · last release Feb 2023, no longer updated |
- HighGraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segmentsGHSA-c4qx-w738-7hr3 · 22 Oct 2026
- 12.x12.0.0 – 12.0.1Fixed in 12.0.2
- 11.x11.0.0 – 11.2.2No fix on 11.x · move to 12.0.2
- 10.x10.10.1 – 10.11.0No fix on 10.x · move to 12.0.2
- HighGraphQL Tools has prototype pollution in well-established utility function `mergeDeep`GHSA-7mx3-vvmw-hjmv · 5 Oct 2026
- 12.x12.0.0Fixed in 12.0.1
- 11.x11.0.0 – 11.2.2No fix on 11.x · move to 12.0.1
- 10.x10.0.0 – 10.11.0No fix on 10.x · move to 12.0.1
- 9.x and older6.0.0 – 9.2.1No fix, no longer updated · move to 12.0.1
Registry facts last checked 24 Oct 2026. Releases and advisories last read 24 Oct 2026.