## GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

- 種別: advisory
- 重大度: high
- 関連技術: nodejs, github
- CVE: CVE-2026-114604
- 公開日時: 2026-10-22T16:28:31.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-c4qx-w738-7hr3)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-c4qx-w738-7hr3

影響: npm:@graphql-tools/utils >= 10.10.1, <= 12.0.1 → 12.0.2
Report metadata | Field | Value | | --- | --- | | Package | @graphql-tools/utils (npm, pkg:github/ardatan/graphql-tools) | | Repository | https://github.com/ardatan/graphql-tools | | Component | mergeIncrementalResult / setObjectKeyPath (packages/utils/src/mergeIncrementalResult.ts) | | Vulnerability class | Prototype pollution (via unvalidated object path traversal) | | Verified against | Source read at 134d67ae36a559651f43ec7fe4a9da76f4a00c2b; master HEAD ccca0ff0dc8ea20726fd116b2f19a38709c30…