apollo-server
3.13.0 · 14 Nov 2023MIT118k / weekRepositoryHomepagenpmAtom feed
Deprecated by its maintainers: The `apollo-server` package is part of Apollo Server v2 and v3, which are now end-of-life (as of October 22nd 2023 and October 22nd 2024, respectively). This package's functionality is now found in the `@apollo/server` package. See https://www.apollographql.com/docs/apollo-server/previous-versions/ for more details.What to use instead
Your version
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
| Line | Newest | Where it stands |
|---|---|---|
| 3.13.0 | 1 open advisory, worst high | |
| 2.26.2 | 5 open advisories, worst high · last release Aug 2023, no longer updated |
- HighApollo Serve vulnerable to Denial of Service with `startStandaloneServer`GHSA-mp6q-xf9x-fwf7 · 4 Feb 2026no fix on 3.x yet
- HighCross-site Scripting Vulnerability in GraphQL Playground (distributed by Apollo Server)GHSA-qm7x-rc44-rrqw · 8 Nov 2021fixed in 3.4.1, 2.25.3
- ModerateThe graphql-upload library included in Apollo Server 2 is vulnerable to CSRF mutationsGHSA-2p3c-p3qw-69r4 · 12 Oct 2022fixed in 2.25.4
- ModerateIntrospection in schema validation in Apollo ServerGHSA-w42g-7vfc-xf37 · 5 Jun 2020fixed in 2.14.2
Registry facts last checked 28 Oct 2026. Releases and advisories last read 28 Oct 2026.