# CVE-2026-23897: Apollo Server denial of service in startStandaloneServer

Source: https://junglewise.ai/threats/cve-2026-23897-apollo-server-denial-of-service-in-startstandaloneserver  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-23897 · Severity: low · CVSS 3.1 · Published 2026-02-04

Apollo Server is a widely-used GraphQL API framework. The default configuration of its standalone server is vulnerable to denial-of-service attacks when attackers send specially crafted HTTP requests with exotic character set encodings, causing the server to consume excessive resources and become unavailable to legitimate users.

Technologies: [apollo-server (npm)](https://junglewise.ai/threats/technologies/apollo-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-23897 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-23897 being exploited in the wild.

**How severe is CVE-2026-23897?** Low severity, with a CVSS score of 3.1, published 4 February 2026.

**Which products and versions are affected?** apollo-server (npm) SEMVER:introduced=2.0.0,last_affected=3.13.0.

**Is there a fix for CVE-2026-23897?** A patch was published on 2026-02-04: Patches released in @apollo/server 5.4.0 and 4.13.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-23897 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-23897?** Check whether you run apollo-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the default request body parsing logic of @apollo/server/standalone, which accepts request bodies in non-standard character set encodings beyond the JSON RFC 7159 specification. An unauthenticated remote attacker can send HTTP requests with carefully crafted encodings (non-UTF-8/UTF-16/UTF-32) to trigger excessive resource consumption and denial of service. The attack requires no authentication or user interaction and is exploitable from any network-accessible Apollo Server instance using startStandaloneServer directly. Patches restrict accepted encodings to UTF-8, UTF-16 (LE/BE), and UTF-32 (LE/BE), rejecting others with a 415 error. Versions 5.4.0 and 4.13.0 include fixes; v3 and v2 remain unpatched as they are end-of-life.

## Affected products

- Apollo @apollo/server 4.2.0 to 4.12.x (fixed in 4.13.0), 5.0.0 to 5.3.x (fixed in 5.4.0)
- Apollo apollo-server 2.0.0 through 3.13.0 (end-of-life, unpatched)

## Identifiers

- CVE-2026-23897
- GHSA-mp6q-xf9x-fwf7

## Timeline

- 2026-02-04: disclosed: Advisory published
- 2026-02-04: patched: Patches released in @apollo/server 5.4.0 and 4.13.0

## References

- [https://github.com/apollographql/apollo-server/security/advisories/GHSA-mp6q-xf9x-fwf7](https://github.com/apollographql/apollo-server/security/advisories/GHSA-mp6q-xf9x-fwf7)

## Related threats

- [Apollo Server XS-Search bypass via browser CORS bug](https://junglewise.ai/threats/apollo-server-xs-search-bypass-via-browser-cors-bug-108494ad)
- [Apollo Server sensitive information exposure in logging](https://junglewise.ai/threats/apollo-server-sensitive-information-exposure-in-logging-64cb113a)
- [Apollo apollo-server improper CSP via nonce reuse](https://junglewise.ai/threats/apollo-apollo-server-improper-csp-via-nonce-reuse-81a87dc6)
- [Apollo Server incorrect cache-control header in batched requests](https://junglewise.ai/threats/apollo-server-incorrect-cache-control-header-in-batched-requests-d59ff0b9)
- [Apollo Server CSRF mutation in graphql-upload library](https://junglewise.ai/threats/apollo-server-csrf-mutation-in-graphql-upload-library-af4ce0a5)