# CVE-2026-114604

Prototype-pollution in @graphql-tools/utils allows Object.prototype writes via incremental GraphQL results

- Page: https://www.vulneraibility.com/cve/CVE-2026-114604
- CVSS: 8.4
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-1321
- Published: 2026-11-05

## Affected versions

- ardatan graphql-tools: affected >= 10.10.1 and < 12.0.2

A version outside these ranges is not a statement that it is unaffected.

## Impact

Untrusted @defer/@stream incremental results can write to Object.prototype (prototype pollution), enabling escalation and possible remote code execution in Node.js services.

## Action

Patch when possible

## Recommendation

Upgrade @graphql-tools/utils to >=12.0.2; avoid merging untrusted incremental results and validate inputs.

## References

- [other] https://github.com/ardatan/graphql-tools/security/advisories/GHSA-c4qx-w738-7hr3
- [other] https://github.com/ardatan/graphql-tools/pull/8467
- [other] https://github.com/ardatan/graphql-tools/commit/19f5b3373fd7ace0688d19950fc529ce8347952a
- [other] https://github.com/ardatan/graphql-tools/commit/20d36a5c6eb8fd5524420988e01a48618c450d70
- [other] https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/utils@12.0.2

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.