# Apollo Server incorrect cache-control header in batched requests

Source: https://junglewise.ai/threats/apollo-server-incorrect-cache-control-header-in-batched-requests-d59ff0b9  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-11-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2022-11-02

Apollo Server is a GraphQL runtime that processes client requests and sends responses. When clients send multiple GraphQL operations in a single batched HTTP request, the server may return an incorrect cache-control header that reflects the policy of only one operation instead of all operations. This could cause sensitive or session-specific data to be cached and shared inappropriately in CDNs or reverse proxies, potentially exposing one user's data to other users.

Technologies: [apollo-server (npm)](https://junglewise.ai/threats/technologies/apollo-server), [apollo-server-core (npm)](https://junglewise.ai/threats/technologies/apollo-server-core). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 2 November 2022.

**Which products and versions are affected?** apollo-server (npm) SEMVER:introduced=0,fixed=4.1.0; apollo-server-core (npm) SEMVER:introduced=3.0.0,fixed=3.11.0.

**Is there a fix for This vulnerability?** Yes. apollo-server (npm): upgrade to 4.1.0 or later; apollo-server-core (npm): upgrade to 3.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run apollo-server (npm) or apollo-server-core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- apollo-server (npm): upgrade to 4.1.0 or later

  ```sh
  npm install apollo-server@4.1.0
  ```

- apollo-server-core (npm): upgrade to 3.11.0 or later

  ```sh
  npm install apollo-server-core@3.11.0
  ```


## Technical details

The vulnerability is an incorrect cache-control header generation (CWE-524) that occurs when Apollo Server processes batched HTTP requests containing multiple GraphQL operations with differing cache policies. In Apollo Server 3 and 4, the response header merging logic arbitrarily selects one operation's cache-control value when multiple operations specify different policies. An attacker can craft a batched POST request combining an operation that should not be cached (containing session-specific data) with an operation that can be cached, resulting in a response header that permits caching the entire response. If the reverse proxy or CDN respects POST request caching, the cached response will include the session-specific data, causing cache poisoning. The vulnerability requires specific server configuration allowing POST caching and does not affect most browser or mobile client caches. Patches are available: Apollo Server 3.11.0+ disables cache-control headers on batched requests entirely; Apollo Server 4.1.0+ implements header merging across all operations.

## Affected products

- Apollo apollo-server-core 3.0.0 to 3.10.x
- Apollo apollo-server 3.0.0 to 3.10.x
- Apollo apollo-server-express 3.0.0 to 3.10.x
- Apollo @apollo/server before 4.1.0

## Timeline

- 2022-11-02: disclosed: Advisory GHSA-8r69-3cvp-wxc3 published
- 2022-11-02: patched: Apollo Server 3.11.0 and 4.1.0 released with fixes

## References

- [https://github.com/apollographql/apollo-server/security/advisories/GHSA-8r69-3cvp-wxc3](https://github.com/apollographql/apollo-server/security/advisories/GHSA-8r69-3cvp-wxc3)
- [https://github.com/apollographql/apollo-server/commit/2a2d1e3b4bbb1f2802b09004444029bd1adb9c19](https://github.com/apollographql/apollo-server/commit/2a2d1e3b4bbb1f2802b09004444029bd1adb9c19)

## Related threats

- [Apollo Server XS-Search bypass via browser CORS bug](https://junglewise.ai/threats/apollo-server-xs-search-bypass-via-browser-cors-bug-108494ad)
- [Apollo Server denial of service in startStandaloneServer](https://junglewise.ai/threats/cve-2026-23897-apollo-server-denial-of-service-in-startstandaloneserver)
- [Apollo Server sensitive information exposure in logging](https://junglewise.ai/threats/apollo-server-sensitive-information-exposure-in-logging-64cb113a)
- [Apollo apollo-server improper CSP via nonce reuse](https://junglewise.ai/threats/apollo-apollo-server-improper-csp-via-nonce-reuse-81a87dc6)
- [Apollo Server CSRF mutation in graphql-upload library](https://junglewise.ai/threats/apollo-server-csrf-mutation-in-graphql-upload-library-af4ce0a5)