AIKIDO-2026-312728
apollo-router is vulnerable to Information Disclosure
53
Medium Risk
This Affects:
apollo-routerTL;DR
Apollo Router constructs validation error messages for GraphQL operations that use input-object–typed variables. When a client supplies an object field that is not defined on the input type, the returned VALIDATION_INVALID_TYPE_VARIABLE error embeds the full composed definition of that input type, including federation composition directives such as @join__type, @join__field, and @tag, along with the internal subgraph names they reference. An unauthenticated client can extract internal supergraph and composition metadata this way even when introspection is disabled and query-validation error redaction is configured. The fix stops the error message from embedding the composed schema definition.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
apollo-router is vulnerable to Information Disclosure in versions 2.12.0 - 2.16.0.
How to fix this
Upgrade the apollo-router library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant