Information Exposure in type-graphql
Summary
GHSA-xf64-2f9p-6pqq: Information Exposure in type-graphql. Affects type-graphql versions < 0.17.6. Fixed in 0.17.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
type-graphql is an npm package that provides decorators and utilities for creating GraphQL schema and resolvers using TypeScript. It simplifies the process of building GraphQL APIs by allowing developers to define the schema and resolvers using TypeScript classes and decorators. This package is widely used in Node.js applications that utilize GraphQL for data querying and manipulation. However, versions prior to 0.17.6 of type-graphql are vulnerable to an information exposure vulnerability.
Vulnerability Detail
The vulnerability in type-graphql (versions prior to 0.17.6) allows an attacker to obtain sensitive information by exploiting an error message leak. When no subscription topics are provided in the request, it is possible to force an error that exposes the source code of the resolver. This can potentially reveal implementation details and sensitive information that should not be exposed to unauthenticated users. The vulnerability has a low severity rating and is classified under CWE-209.
How To Fix
Latest published version: 2.0.0-rc.3 as of 23 Oct 2026
npm install type-graphql@2.0.0-rc.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.17.6
This is the first release that contains the fix.
npm install type-graphql@0.17.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, type-graphql versions prior to 0.17.6 are vulnerable to an information exposure issue that can leak sensitive information in error messages. It is recommended to upgrade to the latest version of the package to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for type-graphql →
FAQ
type-graphql is an npm package that simplifies the process of building GraphQL APIs using TypeScript.
The vulnerability allows an attacker to obtain sensitive information by exploiting an error message leak in type-graphql.
To fix this vulnerability, you need to upgrade to version 0.17.6 or later of the type-graphql package.
No specific workaround has been mentioned for this vulnerability.
The vulnerability has a low severity rating.
