What is the CVSS score of EUVD-2026-12135?

EUVD-2026-12135 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Prototype Pollution are affected by EUVD-2026-12135?

Apollo Federation gateway deployments are vulnerable to a critical prototype pollution flaw (CVE-2026-32621) that could allow attackers to execute arbitrary code and fully compromise the gateway…. A patch is available.

How to fix or mitigate EUVD-2026-12135?

Within 24 hours: Identify all Apollo Federation gateway instances running versions prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2; document business criticality and exposure. Within 7 days: Implement network segmentation to restrict gateway access, deploy WAF rules to block suspicious GraphQL query patterns targeting prototype chain properties, and disable subgraph federation if operationally feasible. Within 30 days: Upgrade to patched versions (2.9.6, 2.10.5, 2.11.6, 2.12.3, 2.13.2 or later) or evaluate alternative GraphQL gateway solutions.

Prototype Pollution EUVD-2026-12135

| CVE-2026-32621 CRITICAL

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-03-13 GitHub_M

GHSA-pfjj-6f4p-rvmh

Information Disclosure Prototype Pollution

9.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 28, 2026 - 21:23 vuln.today

cvss_changed

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 13, 2026 - 21:01 euvd

EUVD-2026-12135

Analysis Generated

Mar 13, 2026 - 21:01 vuln.today

CVE Published

Mar 13, 2026 - 20:29 nvd

CRITICAL 9.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 npm packages depend on @apollo/federation-internals (5 direct, 1 indirect)
1 npm packages depend on @apollo/gateway (1 direct, 0 indirect)
2 npm packages depend on @apollo/query-planner (1 direct, 1 indirect)

Ecosystem-wide dependent count for version 2.10.0 and other introduced versions.

DescriptionGitHub Advisory

Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2, a vulnerability exists in query plan execution within the gateway that may allow pollution of Object.prototype in certain scenarios. A malicious client may be able to pollute Object.prototype in gateway directly by crafting operations with field aliases and/or variable names that target prototype-inheritable properties. Alternatively, if a subgraph were to be compromised by a malicious actor, they may be able to pollute Object.prototype in gateway by crafting JSON response payloads that target prototype-inheritable properties. This vulnerability is fixed in 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2.