Bug 2567593 (CVE-2026-114604)

Summary:	CVE-2026-114604 @graphql-tools/utils: @graphql-tools/utils: Prototype pollution via unvalidated incremental response path segments
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abarbaro, akhatavk, alizardo, aos-team-art-private, asdas, dhanak, dpaolell, drosa, dsimansk, jchui, jdelft, jhe, jlanda, jupierce, kingland, kshier, ktsao, lgarciaa, mbiarnes, mnovotny, nboldt, oaljalju, ppalepu, ppostler, prdhamdh, psrna, rbobbitt, sausingh, sghai, sidsharm, simaishi, stcannon, suppawar, vlaad, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in @graphql-tools/utils. A remote attacker or compromised upstream GraphQL service can exploit this vulnerability by supplying crafted incremental response path segments during streaming or deferred GraphQL operations. Because the helper function fails to validate data types before checking property names, malicious values can bypass safety checks. This allows an attacker to modify global object properties (prototype pollution), potentially leading to application denial of service (DoS), configuration tampering, or unauthorized privilege escalation.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-05 22:10:36 UTC

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. From 10.10.1 until 12.0.2, the @graphql-tools/utils mergeIncrementalResult helper passes incrementalResult.path segments to setObjectKeyPath without runtime primitive-type validation. A non-primitive segment can bypass strict comparisons against __proto__, constructor, and prototype, then be coerced during property access so a malicious or compromised upstream incremental GraphQL response writes attacker-controlled properties to Object.prototype in the consuming Node.js process. The affected implementation is packages/utils/src/mergeIncrementalResult.ts and is reachable when consumers merge untrusted @defer or @stream transport results. This issue is fixed in version 12.0.2.