Detections
Analytics

SCA: security update for @apollo/gateway (GHSA-q2f9-x4p4-7xmh)

high Tenable Cloud Security Plugin ID 424784

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL
 endpoint. Prior to 2.10.1, a vulnerability in Apollo Gateway allowed queries with deeply nested and reused
 named fragments to be prohibitively expensive to query plan, specifically during named fragment expansion.
 Named fragments were being expanded once per fragment spread during query planning, leading to exponential
 resource usage when deeply nested and reused fragments were involved. This could lead to excessive
 resource consumption and denial of service. This has been remediated in @apollo/gateway version 2.10.1.
 (CVE-2025-32030)

See Also

https://github.com/advisories/GHSA-q2f9-x4p4-7xmh

Plugin Details

Severity: High

ID: 424784

Version: Revision 1.10

Type: Local

Family: SCA Checks

Published: 4/8/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2025-32030

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 4/7/2025

Vulnerability Publication Date: 4/7/2025

Reference Information

CVE: CVE-2025-32030

cwe: CWE-770