HIGH GitHub
CVE-2026-114604
GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments
## Report metadata
| Field | Value |
| --- | --- |
| Package | `@graphql-tools/utils` (npm, `pkg:github/ardatan/graphql-tools`) |
| Repository | https://github.com/ardatan/graphql-tools |
| Component | `mergeIncrementalResult` / `setObjectKeyPath` (`packages/utils/src/mergeIncrementalResult.ts`) |
| Vulnerability class | Prototype pollution (via unvalidated object path traversal) |
| Verified against | Source read at `134d67ae36a559651f43ec7fe4a9da76f4a00c2b`; `master` HEAD `ccca0ff0dc8ea20726f
Affected Products
- npm/@graphql-tools/utils >= 10.10.1, <= 12.0.1
References
- https://github.com/advisories/GHSA-c4qx-w738-7hr3
- https://github.com/ardatan/graphql-tools/security/advisories/GHSA-c4qx-w738-7hr3
- https://github.com/ardatan/graphql-tools/pull/8467
- https://github.com/ardatan/graphql-tools/commit/19f5b3373fd7ace0688d19950fc529ce8347952a
This high severity vulnerability was published on 2026-10-22 via GitHub. Affected: npm/@graphql-tools/utils >= 10.10.1, <= 12.0.1.
vulnfeed aggregates 17299 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.