Is CVE-2026-23897 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-23897 being exploited in the wild.

How severe is CVE-2026-23897?

Low severity, with a CVSS score of 3.1, published 4 February 2026.

Which products and versions are affected?

apollo-server (npm) SEMVER:introduced=2.0.0,last_affected=3.13.0.

Is there a fix for CVE-2026-23897?

A patch was published on 2026-02-04: Patches released in @apollo/server 5.4.0 and 4.13.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-23897 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-23897?

Check whether you run apollo-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-23897: Apollo Server denial of service in startStandaloneServer

CVE-2026-23897 · Severity: low · CVSS 3.1 · Published 2026-02-04

Apollo Server is a widely-used GraphQL API framework. The default configuration of its standalone server is vulnerable to denial-of-service attacks when attackers send specially crafted HTTP requests with exotic character set encodings, causing the server to consume excessive resources and become unavailable to legitimate users.

Technologies: apollo-server (npm). Vendors: npm.

Quick answers

Is CVE-2026-23897 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-23897 being exploited in the wild.
How severe is CVE-2026-23897?: Low severity, with a CVSS score of 3.1, published 4 February 2026.
Which products and versions are affected?: apollo-server (npm) SEMVER:introduced=2.0.0,last_affected=3.13.0.
Is there a fix for CVE-2026-23897?: A patch was published on 2026-02-04: Patches released in @apollo/server 5.4.0 and 4.13.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23897 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-23897?: Check whether you run apollo-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the default request body parsing logic of @apollo/server/standalone, which accepts request bodies in non-standard character set encodings beyond the JSON RFC 7159 specification. An unauthenticated remote attacker can send HTTP requests with carefully crafted encodings (non-UTF-8/UTF-16/UTF-32) to trigger excessive resource consumption and denial of service. The attack requires no authentication or user interaction and is exploitable from any network-accessible Apollo Server instance using startStandaloneServer directly. Patches restrict accepted encodings to UTF-8, UTF-16 (LE/BE), and UTF-32 (LE/BE), rejecting others with a 415 error. Versions 5.4.0 and 4.13.0 include fixes; v3 and v2 remain unpatched as they are end-of-life.

Affected products

Apollo @apollo/server 4.2.0 to 4.12.x (fixed in 4.13.0), 5.0.0 to 5.3.x (fixed in 5.4.0)
Apollo apollo-server 2.0.0 through 3.13.0 (end-of-life, unpatched)

Identifiers

CVE-2026-23897
GHSA-mp6q-xf9x-fwf7

Timeline

2026-02-04: disclosed: Advisory published
2026-02-04: patched: Patches released in @apollo/server 5.4.0 and 4.13.0

References

https://github.com/apollographql/apollo-server/security/advisories/GHSA-mp6q-xf9x-fwf7

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.