apollographql apollo-server up to 3.13.0/4.12.x/5.3.x startStandaloneServer redos

Summaryinfo

A vulnerability described as problematic has been identified in apollographql apollo-server up to 3.13.0/4.12.x/5.3.x. This affects an unknown part. The manipulation of the argument startStandaloneServer results in redos. This vulnerability is reported as CVE-2026-23897. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic has been found in apollographql apollo-server up to 3.13.0/4.12.x/5.3.x. Affected is an unknown code block. The manipulation of the argument startStandaloneServer with an unknown input leads to a redos vulnerability. CWE is classifying the issue as CWE-1333. The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. This is going to have an impact on availability. CVE summarizes:

Apollo Server is an open-source, spec-compliant GraphQL server that's compatible with any GraphQL client, including Apollo Client. In versions from 2.0.0 to 3.13.0, 4.2.0 to before 4.13.0, and 5.0.0 to before 5.4.0, the default configuration of startStandaloneServer from @apollo/server/standalone is vulnerable to denial of service (DoS) attacks through specially crafted request bodies with exotic character set encodings. This issue does not affect users that use @apollo/server as a dependency for integration packages, like @as-integrations/express5 or @as-integrations/next, only direct usage of startStandaloneServer.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-23897 since 01/16/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1449.003.

Upgrading to version 4.13.0 or 5.4.0 eliminates this vulnerability. Applying the patch d25a5bdc377826ad424fcf7f8d1d062055911643 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• apollographql

Name

• apollo-server

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13.0
• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.11
• 4.12
• 5.0
• 5.1
• 5.2
• 5.3

License

• open-source

Website

• Product: https://github.com/apollographql/apollo-server/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion