Is CVE-2025-32031 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-32031 being exploited in the wild.

How severe is CVE-2025-32031?

Low severity, with a CVSS score of 3.1, published 7 April 2025.

Which products and versions are affected?

@apollo/gateway (npm) SEMVER:introduced=0,fixed=2.10.1.

Is there a fix for CVE-2025-32031?

Yes. @apollo/gateway (npm): upgrade to 2.10.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-32031 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2025-32031?

Check whether you run @apollo/gateway (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-32031: Apollo Gateway Query Planner denial of service via optimization bypass

CVE-2025-32031 · Severity: low · CVSS 3.1 · Published 2025-04-07

Apollo Gateway is a GraphQL API gateway that routes and executes queries across federated services. A vulnerability in its query planner allows attackers to craft deeply nested and reused named fragments that bypass internal optimizations, causing excessive CPU consumption and rendering the gateway unresponsive. This can result in service outages affecting all downstream applications and users dependent on the gateway.

Technologies: @apollo/gateway (npm). Vendors: npm.

Quick answers

Is CVE-2025-32031 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-32031 being exploited in the wild.
How severe is CVE-2025-32031?: Low severity, with a CVSS score of 3.1, published 7 April 2025.
Which products and versions are affected?: @apollo/gateway (npm) SEMVER:introduced=0,fixed=2.10.1.
Is there a fix for CVE-2025-32031?: Yes. @apollo/gateway (npm): upgrade to 2.10.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-32031 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2025-32031?: Check whether you run @apollo/gateway (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@apollo/gateway (npm): upgrade to 2.10.1 or later
```
npm install @apollo/gateway@2.10.1
```

Technical details

This vulnerability is a resource exhaustion flaw (CWE-770) in the Apollo Gateway query planner. Queries with deeply nested and reused named fragments generate many selections that bypass the existing optimization intended to speed up query planning, resulting in significantly longer planning times. The query planner lacks a timeout mechanism, allowing a small number of malicious queries to consume excessive CPU and memory resources without bounds. Attack preconditions are minimal: the attacker needs network access to submit GraphQL queries (no authentication required). An attacker can trigger denial of service by submitting crafted queries. The vulnerability has been patched in @apollo/gateway version 2.10.1, which introduces a Query Optimization Limit metric to enforce a ceiling on unoptimizable selections.

Affected products

Apollo Gateway < 2.10.1

Identifiers

CVE-2025-32031
GHSA-p2q6-pwh5-m6jr

Timeline

2025-04-07: disclosed
2025-04-07: patched: patched in @apollo/gateway version 2.10.1

References

https://github.com/apollographql/federation/security/advisories/GHSA-p2q6-pwh5-m6jr

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.