# Apollo Server CSRF mutation in graphql-upload library

Source: https://junglewise.ai/threats/apollo-server-csrf-mutation-in-graphql-upload-library-af4ce0a5  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-10-12. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

Severity: info · CVSS 5.4 · Published 2022-10-12

Apollo Server 2, a popular tool for building data interfaces (APIs), contains a security flaw in its file upload component. This flaw allows an attacker to trick a user's browser into performing unauthorized actions on the server, such as modifying data, without the user's knowledge. This occurs because the server processes certain types of web requests that bypass standard browser security checks.

Technologies: [apollo-server (npm)](https://junglewise.ai/threats/technologies/apollo-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, with a CVSS score of 5.4, published 12 October 2022.

**Which products and versions are affected?** apollo-server (npm) SEMVER:introduced=2.0.0,fixed=2.25.4.

**Is there a fix for This vulnerability?** Yes. apollo-server (npm): upgrade to 2.25.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run apollo-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- apollo-server (npm): upgrade to 2.25.4 or later

  ```sh
  npm install apollo-server@2.25.4
  ```


## Technical details

Apollo Server 2 bundles the 'graphql-upload' library and enables it by default. This library processes 'multipart/form-data' POST requests, which are classified as 'simple requests' by browsers and thus bypass CORS preflight checks. If a server uses cookie-based authentication with 'SameSite=None' or relies on network-level security (like a private IP), an attacker can craft a malicious website that triggers authenticated GraphQL mutations on the victim's server. While the attacker cannot see the response due to CORS, the side effects of the mutation (data modification) are executed. The vulnerability is mitigated in version 2.25.4 by disabling the upload middleware if it is not explicitly used in the schema, though full CSRF protection requires upgrading to Apollo Server 3.7+.

## Affected products

- Apollo GraphQL apollo-server 2.0.0 - 2.25.3

## Timeline

- 2022-05-25: patched: Fix committed to Apollo Server 2 branch
- 2022-10-12: advisory: GitHub Security Advisory published

## References

- [https://github.com/apollographql/apollo-server/security/advisories/GHSA-2p3c-p3qw-69r4](https://github.com/apollographql/apollo-server/security/advisories/GHSA-2p3c-p3qw-69r4)
- [https://github.com/jaydenseric/graphql-multipart-request-spec/pull/64](https://github.com/jaydenseric/graphql-multipart-request-spec/pull/64)
- [https://github.com/apollographql/apollo-server/commit/82d44985ddca8e61557957d67f41e9c1a705a5ca](https://github.com/apollographql/apollo-server/commit/82d44985ddca8e61557957d67f41e9c1a705a5ca)
- [https://github.com/apollographql/apollo-server](https://github.com/apollographql/apollo-server)

## Related threats

- [Apollo Server XS-Search bypass via browser CORS bug](https://junglewise.ai/threats/apollo-server-xs-search-bypass-via-browser-cors-bug-108494ad)
- [Apollo Server denial of service in startStandaloneServer](https://junglewise.ai/threats/cve-2026-23897-apollo-server-denial-of-service-in-startstandaloneserver)
- [Apollo Server sensitive information exposure in logging](https://junglewise.ai/threats/apollo-server-sensitive-information-exposure-in-logging-64cb113a)
- [Apollo apollo-server improper CSP via nonce reuse](https://junglewise.ai/threats/apollo-apollo-server-improper-csp-via-nonce-reuse-81a87dc6)
- [Apollo Server incorrect cache-control header in batched requests](https://junglewise.ai/threats/apollo-server-incorrect-cache-control-header-in-batched-requests-d59ff0b9)