Excessive Resource Consumption Vulnerability in Apollo Gateway - GHSA-p2q6-pwh5-m6jr
Summary
CVE-2025-32031: Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass. Affects @apollo/gateway versions < 2.10.1. Fixed in 2.10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apollo Gateway is a powerful tool that enables developers to create a unified GraphQL API by composing multiple GraphQL services. It optimizes query planning to enhance performance and reduce latency. However, it is susceptible to vulnerabilities that can lead to excessive resource consumption, particularly when handling complex queries with deeply nested and reused named fragments.
Vulnerability Detail
A vulnerability in Apollo Gateway allows queries with deeply nested and reused named fragments to bypass internal optimizations, resulting in prohibitively expensive query planning. This can lead to excessive resource consumption and potential denial of service, as the query planner does not enforce a timeout, making the gateway inoperable under certain conditions.
How To Fix
Latest published version: 2.14.4 as of 22 Oct 2026
npm install @apollo/gateway@2.14.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.10.1
This is the first release that contains the fix.
npm install @apollo/gateway@2.10.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no known direct workarounds for this vulnerability. It is recommended to apply the patch as soon as possible to mitigate the risk.
Conclusion
The Apollo Gateway vulnerability GHSA-p2q6-pwh5-m6jr poses a significant risk due to excessive resource consumption from complex queries. It is crucial to update to the patched version 2.10.1 to mitigate this risk and ensure the stability of your GraphQL API.
See every vulnerability recorded for @apollo/gateway →
FAQ
The vulnerability allows certain complex GraphQL queries to bypass optimizations, leading to excessive resource consumption.
It can result in denial of service, making the Apollo Gateway inoperable due to prolonged query planning times.
You can use Vulert's playground at Vulert Scanner to monitor and alert for open-source vulnerabilities in your application.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Yes, Vulert can monitor your application for vulnerabilities using just the package-lock.json file, without requiring access to the code.
References
Related vulnerabilities
Recent vulnerabilities recorded for @apollo/gateway.
