Update GraphQL Tools Utils to 12.0.2 to Fix High Severity Prototype Pollution Flaw

The npm package @graphql-tools/utils versions 10.10.1 through 12.0.1 contain a high severity vulnerability identified as CVE-2026-114604. According to GitHub advisory GHSA-c4qx-w738-7hr3, a fix is available in version 12.0.2. This issue affects the `mergeIncrementalResult` and `setObjectKeyPath` components within the package. The flaw exists in the default configuration with no additional options required to trigger it.

In plain English

The vulnerability is a prototype pollution issue caused by unvalidated object path traversal. The function `mergeIncrementalResult` merges incremental GraphQL response parts into an execution result. It uses `setObjectKeyPath` to assign values at resolved locations. The code attempts to block dangerous segments by checking for strict string equality against `__proto__`, `constructor`, and `prototype`. However, it fails to validate that a path segment is a primitive string or number.

The background

An attacker can supply a JSON path segment like `["__proto__"]`, which is an array object. Because an array is not strictly equal to the string `__proto__`, the guard passes. The next statement coerces the array into the string key `__proto__`, resolving `Object.prototype`. Subsequent segments are then assigned directly onto `Object.prototype`. This flaw was introduced when the `dset` dependency was removed in commit `fbb58b51c4993ba9680ce6c2ef7203ab3a142713`.

What changes now

Version 12.0.2 addresses this issue. The advisory notes that version 10.10.0 does not reproduce the flaw, but versions 11.0.0, 12.0.0, and 12.0.1 do. The affected API surface is a public, documented export. The vulnerability was verified against source reads and published npm builds. Teams should verify their dependency tree to ensure they are not pulling in vulnerable transitive dependencies.

Who needs to act first

Security teams should prioritize updating systems that process untrusted GraphQL inputs, especially those using incremental delivery features like defer or stream. Before deploying the patch, test the update in a staging environment to ensure compatibility with existing application logic. Back up current configurations and dependencies to allow for quick rollback if issues arise. Monitor logs for unusual object modifications or unexpected behavior after the update. Reduce exposure by validating all incoming data structures before processing.

Background: Prototype pollution

Prevent prototype pollution by freezing object prototypes and using safe merge utilities that ignore special keys. Avoid direct object assignment for untrusted data. Implement strict schema validation at every boundary where external data enters your application logic.

Read the full guide: Stop Prototype Pollution: Practical Prevention for JavaScript Apps

What to do and how to stay safe: @graphql-tools/utils

• Audit your project dependencies to identify if @graphql-tools/utils version 10.10.1 through 12.0.1 is present.
• Upgrade to version 12.0.2 or later once the vendor provides the update.
• Implement strict input validation for all GraphQL queries and mutations to prevent malformed path segments.
• Monitor application logs for signs of prototype pollution, such as unexpected properties appearing on base objects.

Step-by-step guide: Stop Path Traversal Attacks: Defense Strategies That Actually Work

General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of @graphql-tools/utils are vulnerable?

Versions 10.10.1 through 12.0.1 are affected by the prototype pollution vulnerability.

Is there a patch available for CVE-2026-114604?

Yes, version 12.0.2 of the npm package contains the fix.

How does the vulnerability bypass the existing security checks?

It bypasses checks by using array objects for path segments, which fail strict string equality tests against forbidden keys.