@graphql-tools/utils CVE-2026-104852

Exploitation requires a GraphQL gateway or schema-stitching deployment built on @graphql-tools/utils <= 12.0.0 (e.g. Hive Gateway, which also required its own delegate/federation fix in PR 2600) where at least one object type is merged from two subgraphs - the normal @shareable field or cross-subgraph entity resolution case. Only then does mergeDeep run over client-controlled response keys, so the attacker aliases fields to constructor, __proto__, or prototype to reach the prototype chain. No authentication (PR:N) and no user interaction (UI:N) are needed. The principal limiting factor is the deployment topology: a single-subgraph, non-merging GraphQL server does not invoke the vulnerable merge path and is not affected; the flaw is also absent once upgraded to 12.0.1.

This is a genuine, actionable priority rather than a paper-high CVSS. All signals align toward real risk: the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VA:H) describes a remote, unauthenticated, low-complexity attack that a single GraphQL query triggers, and the GHSA advisory publishes a working trigger query, so exploitation is trivial and reproducible. The impact profile is availability-only (VC:N/VI:N/VA:H) - despite the CWE-1321 'prototype pollution' classification, the realistic outcome described is a persistent denial of service: overwriting Function.prototype.call breaks every subsequent request until the process is restarted, i.e. an unauthenticated client can take a gateway offline. The one tempering signal is the input vector's AT:P (attack requirement present), reflecting that the server must actually merge an object across two subgraphs; however, the advisory states this is the 'ordinary @shareable or entity case,' so in practice the precondition is satisfied by typical federation deployments and does not meaningfully reduce exposure. No EPSS score and no CISA KEV entry were provided; absence of KEV is expected for a freshly disclosed npm library CVE and should not be read as low risk. Note the impact is NOT confidentiality or integrity (VC/VI = N) - this is destructive availability, not code execution, which should be reflected in prioritization.

An unauthenticated attacker sends a single crafted GraphQL query to a federated gateway (e.g. Hive Gateway) in which a shared object type is resolved from two subgraphs, aliasing response fields to constructor, __proto__ and prototype. During result merging, mergeDeep walks the prototype chain and overwrites Function.prototype.call with attacker-supplied data, which breaks all subsequent request handling until the gateway process is restarted. A demonstrative trigger query is published in the GHSA advisory, so a functional proof-of-concept is effectively public.