# CVE-2025-32030: Apollo Gateway query planner denial of service via fragment expansion

Source: https://junglewise.ai/threats/cve-2025-32030-apollo-gateway-query-planner-denial-of-service-via-fragment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-04-07. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-32030 · Severity: low · CVSS 3.1 · Published 2025-04-07

Apollo Gateway is a service that routes and combines queries across multiple GraphQL APIs. A vulnerability in its query planning engine allows attackers to send specially crafted queries with deeply nested named fragments that consume excessive CPU and memory, causing the gateway to become unresponsive and denying legitimate traffic. This could disrupt API services relying on Apollo Gateway for GraphQL federation.

Technologies: [@apollo/gateway (npm)](https://junglewise.ai/threats/technologies/apollo-gateway). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-32030 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-32030 being exploited in the wild.

**How severe is CVE-2025-32030?** Low severity, with a CVSS score of 3.1, published 7 April 2025.

**Which products and versions are affected?** @apollo/gateway (npm) SEMVER:introduced=0,fixed=2.10.1.

**Is there a fix for CVE-2025-32030?** Yes. @apollo/gateway (npm): upgrade to 2.10.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-32030 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-32030?** Check whether you run @apollo/gateway (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @apollo/gateway (npm): upgrade to 2.10.1 or later

  ```sh
  npm install @apollo/gateway@2.10.1
  ```


## Technical details

The vulnerability is an uncontrolled resource allocation flaw (CWE-770) in the query planner's named fragment expansion logic. Named fragments were being expanded once per fragment spread during query planning without limits, leading to exponential resource consumption when deeply nested and reused fragments were combined. An unauthenticated network attacker can submit a malicious GraphQL query to trigger this condition; no special privileges or user interaction is required. The attack results in denial of service through CPU and memory exhaustion. The fix introduces a Query Fragment Expansion Limit metric that caps the number of selections a query can expand to, preventing excessive computation. Patches are available in @apollo/gateway 2.10.1 and later.

## Affected products

- Apollo Gateway < 2.10.1

## Identifiers

- CVE-2025-32030
- GHSA-q2f9-x4p4-7xmh

## Timeline

- 2025-04-07: disclosed
- 2025-04-07: patched: Fixed in @apollo/gateway 2.10.1

## References

- [https://github.com/apollographql/federation/security/advisories/GHSA-q2f9-x4p4-7xmh](https://github.com/apollographql/federation/security/advisories/GHSA-q2f9-x4p4-7xmh)

## Related threats

- [Apollo Gateway Query Planner denial of service via optimization bypass](https://junglewise.ai/threats/cve-2025-32031-apollo-gateway-query-planner-denial-of-service-via-optimization)
- [Apollo Query Planner infinite loop on complex queries](https://junglewise.ai/threats/cve-2024-43414-apollo-query-planner-infinite-loop-on-complex-queries)
- [Apollo Gateway prototype pollution via deepMerge](https://junglewise.ai/threats/apollo-gateway-prototype-pollution-via-deepmerge-d1328d9d)