Executive brief
Apollo Server is a widely-used GraphQL API framework. The default configuration of its standalone server is vulnerable to denial-of-service attacks when attackers send specially crafted HTTP requests with exotic character set encodings, causing the server to consume excessive resources and become unavailable to legitimate users.
Technical details
The vulnerability exists in the default request body parsing logic of @apollo/server/standalone, which accepts request bodies in non-standard character set encodings beyond the JSON RFC 7159 specification. An unauthenticated remote attacker can send HTTP requests with carefully crafted encodings (non-UTF-8/UTF-16/UTF-32) to trigger excessive resource consumption and denial of service. The attack requires no authentication or user interaction and is exploitable from any network-accessible Apollo Server instance using startStandaloneServer directly. Patches restrict accepted encodings to UTF-8, UTF-16 (LE/BE), and UTF-32 (LE/BE), rejecting others with a 415 error. Versions 5.4.0 and 4.13.0 include fixes; v3 and v2 remain unpatched as they are end-of-life.
Affected products
- Apollo @apollo/server 4.2.0 to 4.12.x (fixed in 4.13.0), 5.0.0 to 5.3.x (fixed in 5.4.0)
- Apollo apollo-server 2.0.0 through 3.13.0 (end-of-life, unpatched)
Timeline
- 2026-02-04: disclosed: Advisory published
- 2026-02-04: patched: Patches released in @apollo/server 5.4.0 and 4.13.0