Executive brief
GraphQL Mesh is a library that enables integration of multiple GraphQL APIs. A vulnerability in its request handling causes cached authentication tokens and other variables to be reused across different client requests. An attacker who sends a request with valid credentials can cause subsequent requests from other users to incorrectly use those same credentials, potentially leading to unauthorized access or data exposure.
Technical details
The vulnerability is a caching logic error (CWE-400/401) in @graphql-mesh/runtime versions 0.96.5–0.96.8. When transforms are applied at the root level or to a single data source, the runtime caches parsed GraphQL operations (DocumentNode) but fails to differentiate between requests carrying different variables. When a client sends the same query with different variables (e.g., different authentication tokens), the cached execution reuses the initial variables instead of the new ones. This affects operations until the LRU cache evicts the DocumentNode. The vulnerability requires network access and authenticated requests to trigger; it does not require user interaction. Patching is available in version 0.96.9.
Affected products
- GraphQL Mesh @graphql-mesh/runtime 0.96.5 to 0.96.8
Timeline
- 2023-10-10: disclosed: Advisory published
- 2023-10-10: patched: Fixed in @graphql-mesh/runtime 0.96.9