CVE-2026-23897: Apollo Server Denial of Service Vulnerability in startStandaloneServer
Summary
CVE-2026-23897: Apollo Serve vulnerable to Denial of Service with startStandaloneServer. Affects apollo-server versions >= 2.0.0, <= 3.13.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apollo Server is a community-driven, open-source GraphQL server that enables developers to build and serve GraphQL APIs. It provides a flexible and powerful framework for integrating with various web frameworks and supports features like subscriptions, file uploads, and more. However, a vulnerability has been identified in the startStandaloneServer function, which can lead to Denial of Service (DoS) attacks when improperly configured.
Vulnerability Detail
The vulnerability arises from the default configuration of the startStandaloneServer function in the @apollo/server/standalone package. It is susceptible to Denial of Service (DoS) attacks through specially crafted request bodies that utilize exotic character set encodings. This issue primarily affects users who directly use startStandaloneServer, as opposed to those utilizing Apollo Server through integration packages. The vulnerability exists in versions v5.0.0 through v5.3.x and all releases of end-of-life major versions v4, v3, and v2.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading is not feasible, users of Apollo Server v2 or v3 can switch from the standalone apollo-server package to an integration package like apollo-server-express or apollo-server-koa. This requires setting up their own server. Here is an example of how to set up an Express server with Apollo Server:
const express = require('express');
const { ApolloServer } = require('@apollo/server-express');
const app = express();
const server = new ApolloServer({ typeDefs, resolvers });
server.start().then(() => {
server.applyMiddleware({ app });
app.listen({ port: 4000 }, () => {
console.log('Server ready at http://localhost:4000' + server.graphqlPath);
});
});
Conclusion
In summary, the CVE-2026-23897 vulnerability in Apollo Server's startStandaloneServer function poses a significant risk of Denial of Service attacks. Users are advised to upgrade to the latest patched versions or implement workarounds to mitigate the risk. Regular monitoring for vulnerabilities using tools like Vulert is recommended.
See every vulnerability recorded for apollo-server →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
The vulnerability affects Apollo Server versions v5.0.0 through v5.3.x, as well as all releases of end-of-life major versions v4, v3, and v2.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
The vulnerability can lead to Denial of Service (DoS) attacks, potentially causing the server to become unresponsive to legitimate requests.
If upgrading is not possible, consider switching to an integration package like apollo-server-express or apollo-server-koa as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for apollo-server.
