GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. From 10.10.1 until 12.0.2, the @graphql-tools/utils mergeIncrementalResult helper passes incrementalResult.path segments to setObjectKeyPath without runtime primitive-type validation. A non-primitive segment can bypass strict comparisons against __proto__, constructor, and prototype, then be coerced during property access so a malicious or compromised upstream incremental GraphQL response writes attacker-controlled properties to Object.prototype in the consuming Node.js process. The affected implementation is packages/utils/src/mergeIncrementalResult.ts and is reachable when consumers merge untrusted @defer or @stream transport results. This issue is fixed in version 12.0.2.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. From 10.10.1 until
    12.0.2, the @graphql-tools/utils mergeIncrementalResult helper passes incrementalResult.path segments to
    setObjectKeyPath without runtime primitive-type validation. A non-primitive segment can bypass strict
    comparisons against __proto__, constructor, and prototype, then be coerced during property access so a
    malicious or compromised upstream incremental GraphQL response writes attacker-controlled properties to
    Object.prototype in the consuming Node.js process. The affected implementation is
    packages/utils/src/mergeIncrementalResult.ts and is reachable when consumers merge untrusted @defer or
    @stream transport results. This issue is fixed in version 12.0.2. (CVE-2026-114604)

ID	Name	Product	Family	Type	Severity
477409	Chainguard: gitlab-rails-ce-fips-19.2: security update to 19.2.9-r3	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
477409	Chainguard: gitlab-rails-ce-fips-19.2: security update to 19.2.9-r3	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
476839	SCA: security update for @graphql-tools/utils (GHSA-c4qx-w738-7hr3)	Tenable Cloud Security	SCA Checks	Local	high
476839	SCA: security update for @graphql-tools/utils (GHSA-c4qx-w738-7hr3)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-114604

high

Tenable Plugins

high

high

high

high