# Apollo Server XS-Search bypass via browser CORS bug

Source: https://junglewise.ai/threats/apollo-server-xs-search-bypass-via-browser-cors-bug-108494ad  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 4 · Published 2026-03-26

Apollo Server is a popular GraphQL API server that includes built-in protections against Cross-Site Request Forgery (CSRF) and timing-based attacks. A bug in a major web browser's implementation of the CORS security standard allows attackers to bypass these protections and perform XS-Search attacks—measuring response times to infer sensitive information like whether specific fields are null or how many items are in a list. This affects servers that use cookie-based authentication, potentially exposing information about user data or system state without triggering visible side effects.

Technologies: [apollo-server (npm)](https://junglewise.ai/threats/technologies/apollo-server), [apollo-server-core (npm)](https://junglewise.ai/threats/technologies/apollo-server-core). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 4, published 26 March 2026.

**Which products and versions are affected?** apollo-server (npm) SEMVER:introduced=0,fixed=5.5.0; apollo-server-core (npm) SEMVER:introduced=0,last_affected=3.13.0.

**Is there a fix for This vulnerability?** Yes. apollo-server (npm): upgrade to 5.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run apollo-server (npm) or apollo-server-core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- apollo-server (npm): upgrade to 5.5.0 or later

  ```sh
  npm install apollo-server@5.5.0
  ```


## Technical details

This vulnerability exploits a CORS compliance bug in a major browser (introduced in 2025, planned fix in May 2026) that fails to enforce the Cross-Origin Resource Sharing specification. Apollo Server implements CSRF/XS-Search prevention by rejecting GraphQL requests lacking proper CORS preflight, but the browser bug allows certain specially crafted HTTP GET requests with non-standard Content-Type headers to bypass this protection. The attack is network-based, requires the victim to visit attacker-controlled content while authenticated to a GraphQL server using cookies or HTTP Basic Auth, and allows timing-based analysis of response latencies to infer facts about query results without causing mutations. The vulnerability is patched in @apollo/server v5.5.0 by rejecting GET requests with Content-Type headers other than application/json; apollo-server-core has no patched version as it is end-of-life.

## Affected products

- Apollo Server <5.5.0
- Apollo apollo-server-core all versions

## Timeline

- 2026-03-26: disclosed: GHSA-9q82-xgwf-vj6h published
- 2026-03-26: patched: @apollo/server v5.5.0 released
- 2025: other: Browser vendor introduced CORS compliance bug
- 2026-05: other: Browser vendor plans to ship fix

## References

- [https://github.com/apollographql/apollo-server/security/advisories/GHSA-9q82-xgwf-vj6h](https://github.com/apollographql/apollo-server/security/advisories/GHSA-9q82-xgwf-vj6h)
- [https://github.com/apollographql/router/security/advisories/GHSA-hff2-gcpx-8f4p](https://github.com/apollographql/router/security/advisories/GHSA-hff2-gcpx-8f4p)

## Related threats

- [Apollo Server denial of service in startStandaloneServer](https://junglewise.ai/threats/cve-2026-23897-apollo-server-denial-of-service-in-startstandaloneserver)
- [Apollo Server sensitive information exposure in logging](https://junglewise.ai/threats/apollo-server-sensitive-information-exposure-in-logging-64cb113a)
- [Apollo apollo-server improper CSP via nonce reuse](https://junglewise.ai/threats/apollo-apollo-server-improper-csp-via-nonce-reuse-81a87dc6)
- [Apollo Server incorrect cache-control header in batched requests](https://junglewise.ai/threats/apollo-server-incorrect-cache-control-header-in-batched-requests-d59ff0b9)
- [Apollo Server CSRF mutation in graphql-upload library](https://junglewise.ai/threats/apollo-server-csrf-mutation-in-graphql-upload-library-af4ce0a5)