VulertSecurity VulertSecurity

Vulnerability Database · npm · Package report

@graphql-mesh/runtime: vulnerability history, versions and safety

@graphql-mesh/runtime is a package in the npm ecosystem. Vulert records 1 vulnerability for it across 0 release, first recorded in Oct 2023. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
1 vulnerabilities recorded M1
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
0 in the last 12 months

Nothing new recorded in the last year.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all @graphql-mesh/runtime vulnerabilities

Vulert verdict on @graphql-mesh/runtime 0.109.3 i

Updated on 23 Oct 2026

Good news: 0.109.3, the version you would install today, has no known vulnerabilities. Older releases do — the table below lists all 1.

Package health score 90/100
  • Security No known security issues
  • Maintenance Sustainable
  • Popularity Widely used
  • Community Moderate

What to do: Stay on 0.109.3 or newer. This can change: a vulnerability disclosed tomorrow can affect 0.109.3 too — Vulert watches the package and alerts you if that happens. Monitor it with Vulert →

  • Current release 0.109.3 — unaffected i
  • Vulnerabilities on record 1 over 1 year · 0 in the last year i
  • Latest disclosure 10 Oct 2023 i
  • Highest CVSS 5.1 i
  • With no published fix 0 i
  • Depended on by 58 packages i
  • Stars 3,511 i
  • Last release this month i
  • Licence MIT i

Version list, release dates, licence and dependants published by the npm registry, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for @graphql-mesh/runtime, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
0.109.3 13 Oct 2026 none MIT — Details →
0.109.3-alpha-20261013153923-448fd50f8bfb60a5b474ee3c0318ed7d8c3fff10 13 Oct 2026 none MIT — Details →
0.109.3-alpha-20261013153339-1b199e2e5d859906078de0cdec612e525fc16d1e 13 Oct 2026 none MIT — Details →
0.109.3-alpha-20261013153101-9e50b22d45a0d090aad56e7bd9020b795fd7aa34 13 Oct 2026 none MIT — Details →
0.109.3-alpha-20261013151932-c7e46971d2908e4a009a96cd1c0d365bbafcfa6b 13 Oct 2026 none MIT — Details →
0.109.3-alpha-20261012215407-9ab104ea82d1121731323907e091771406554dba 12 Oct 2026 none MIT — Details →
0.109.2 12 Oct 2026 none MIT — Details →
0.109.2-alpha-20261012131254-d0ed24d436f49c2367bd7b1f9284a6b458a6ac54 12 Oct 2026 none MIT — Details →
0.109.2-alpha-20261012130020-35dbd39dc192d5c6282c5fd654357d7d4059b1a6 12 Oct 2026 none MIT — Details →
0.109.2-alpha-20261012125133-37e2679aea1a26d77019a196d114c0219a0e194f 12 Oct 2026 none MIT — Details →
0.109.2-alpha-20261012101750-75459d43d6464d9c0cf03068785d491fa5b43da7 12 Oct 2026 none MIT — Details →
0.109.2-alpha-20261012100111-a3e273d5e4633f60fbff7e80ca544216da53d6d7 12 Oct 2026 none MIT — Details →
0.109.2-alpha-20261009164921-bcde4f5973a81e193fe289a898176e60a0e579a1 09 Oct 2026 none MIT — Details →
0.109.2-alpha-20261007032111-a69930202585049006189825d831ae57b38000ec 07 Oct 2026 none MIT — Details →
0.109.2-alpha-20261007031713-8610d02d0db3cc57a7b6134b90265f9c7db13168 07 Oct 2026 none MIT — Details →
0.109.2-alpha-20261003223514-3617ee1d260ab576bb7535e5dc7e57724b55e150 03 Oct 2026 none MIT — Details →
0.109.2-alpha-20261003222921-5c00b6e86a4f6bc9d4f82d682d70895e9cad7993 03 Oct 2026 none MIT — Details →
0.109.2-alpha-20261003203250-6e6798d6b64b21973ea22a1f742c05fe0ff92545 03 Oct 2026 none MIT — Details →
0.109.2-alpha-20260929160358-03f18a3f6f02049a4efea44693871a1e3bf24d30 29 Sep 2026 none MIT — Details →
0.109.2-alpha-20260916133444-ce8037dc4a09d11d4e7ced5bca17edb26fce20c1 16 Sep 2026 none MIT — Details →
0.109.2-alpha-20260916125759-7f73bcfa0d213b0437586b0bf3d848ed2a740a35 16 Sep 2026 none MIT — Details →
0.109.2-alpha-20260916111231-57a5ca721ed2e4f61ae6f0ebb8e4d5fd46433a29 16 Sep 2026 none MIT — Details →
0.109.1 24 Aug 2026 none MIT — Details →
0.109.1-alpha-20260824170230-ae4841286ab9e75167dd77db1471acd7d105129b 24 Aug 2026 none MIT — Details →
0.109.1-alpha-20260824165539-fa807c4e594ecb473cee9a4cc69e5a1d160af6fa 24 Aug 2026 none MIT — Details →
0.109.1-alpha-20260824163656-e44ecfb832f4114782c798b33c2d013e5a7183b8 24 Aug 2026 none MIT — Details →
0.109.1-alpha-20260824162813-61fabf534298b284ce13e442739d3ff3474c50ca 24 Aug 2026 none MIT — Details →
0.109.0 14 Aug 2026 none MIT — Details →
0.109.0-alpha-20260814174023-84ce2c032e9c1c1ead05c933211220f4254bccfb 14 Aug 2026 none MIT — Details →
0.109.0-alpha-20260814173633-134848b09002a34b40a3bb38252b7eea07eed85e 14 Aug 2026 none MIT — Details →
0.109.0-alpha-20260814172055-978323c4f72c1c8f8e3e3f63e36414b19544e32c 14 Aug 2026 none MIT — Details →
0.109.0-alpha-20260814171542-b132f72a8a8cec4b0551226b11a92b29c00de03c 14 Aug 2026 none MIT — Details →
0.109.0-alpha-20260814171438-1337a284a63c7a78d79c63de3ccaacb48e4c8a6c 14 Aug 2026 none MIT — Details →
0.109.0-alpha-20260814170356-c960de151fd048db69399e095728cead71427e2e 14 Aug 2026 none MIT — Details →
0.109.0-alpha-20260814161732-558d62fd2cb9b141fcedb73ea787778da124a30e 14 Aug 2026 none MIT — Details →
0.108.0 14 Aug 2026 none MIT — Details →
0.108.0-alpha-20260814142946-0955586157248e00f880b4c1f3168d2e7c0e0c61 14 Aug 2026 none MIT — Details →
0.108.0-alpha-20260814142148-703ffe94a8416c626d4ff4f4b01dacd11bf90d2f 14 Aug 2026 none MIT — Details →
0.108.0-alpha-20260814133446-8bb858b7e3639db6e5e99e83cc47e34708c3c42e 14 Aug 2026 none MIT — Details →
0.108.0-alpha-20260814132831-405a8d8c4c1711c252b7e2923c731529ae674c2c 14 Aug 2026 none MIT — Details →
0.108.0-alpha-20260814130806-ee4f618fbc8d6431b9b98a421453d435d00497a2 14 Aug 2026 none MIT — Details →
0.108.0-alpha-20260814130403-3a46a75b3a51d88180fdd5997846559ceb46d001 14 Aug 2026 none MIT — Details →
0.108.0-alpha-20260814125543-4818b158a01c8944ca63ad432b5f5c4b4d9ad70b 14 Aug 2026 none MIT — Details →
0.108.0-alpha-20260813203104-ccb219783d6931a3db5204731aa52afaddcbd0d5 13 Aug 2026 none MIT — Details →
0.107.2-alpha-20260813165234-899af5ab362b3b5b0c0dbfa1df903b7096c620cf 13 Aug 2026 none MIT — Details →
0.107.2-alpha-20260813164830-38358a0e07e0f1a8a9e959dc87e6038128fb9120 13 Aug 2026 none MIT — Details →
0.107.2-alpha-20260813164210-44af674f30850740a0b5d885323101a6d6390732 13 Aug 2026 none MIT — Details →
0.108.0-alpha-20260813163452-f6ff003ed530ee464d9b3d267b9f8c10dde567fe 13 Aug 2026 none MIT — Details →
0.107.2-alpha-20260813161551-0b29a81e983337746753eccab81b4e9efed8c239 13 Aug 2026 none MIT — Details →
0.108.0-alpha-20260813155953-2af7bc4e0b96fd3d2c8f9ef32d9a24e9cd402f77 13 Aug 2026 none MIT — Details →
0.107.2-alpha-20260813154608-7fa90ce2b0dfe1b3867ad86314bd35561a209283 13 Aug 2026 none MIT — Details →
0.107.2-alpha-20260813154553-7fa90ce2b0dfe1b3867ad86314bd35561a209283 13 Aug 2026 none MIT — Details →
0.107.2-alpha-20260813134055-0b8b716307a467be0643ba0552d43db3f5510d16 13 Aug 2026 none MIT — Details →
0.108.0-alpha-20260811172414-22e7d01a0ffd5ba856045e6f20c67d72cae557ad 11 Aug 2026 none MIT — Details →
0.108.0-alpha-20260811162650-966a1958cc1b90f3d70ebd4919914de14a370295 11 Aug 2026 none MIT — Details →
0.108.0-alpha-20260811160933-077a3e4cf676434ddb369f2a079e18aba8ad6516 11 Aug 2026 none MIT — Details →
0.108.0-alpha-20260811160128-f5933376a6303e134e9cc13d9dc025d553b6509f 11 Aug 2026 none MIT — Details →
0.108.0-alpha-20260811155607-21f58a449476e58d5a8843861d50636cf9965b79 11 Aug 2026 none MIT — Details →
0.107.1 02 Aug 2026 none MIT — Details →
0.107.1-alpha-20260802141646-5d1629537464e21b6467bd069cdd6f43b849816d 02 Aug 2026 none MIT — Details →
0.107.0 31 Jul 2026 none MIT — Details →
0.107.0-alpha-20260731093325-56c42638a3e3aef1a8163347ed8d9f13626f80e5 31 Jul 2026 none MIT — Details →
0.106.41-alpha-20260731005054-257ffe8eee484d265494e7a341aec21c1a89a6b2 31 Jul 2026 none MIT — Details →
0.107.0-alpha-20260721125616-85ceb3ca7e8b6092a6bf4e389e8c7d00ab0e59d9 21 Jul 2026 none MIT — Details →
0.106.40 20 Jul 2026 none MIT — Details →
0.106.40-alpha-20260720161859-775fa20ae11be2a500d3eb63b18142baab19d707 20 Jul 2026 none MIT — Details →
0.106.40-alpha-20260720160613-6854f14795d1ac05395f644b16f8fdf26aba04d5 20 Jul 2026 none MIT — Details →
0.106.40-alpha-20260720145753-a9bbec477ec07ad5e973ae3f68460fab8d0cd183 20 Jul 2026 none MIT — Details →
0.106.40-alpha-20260717191133-97ee063bdca630f2b2a02b71b8455ae717fa36a2 17 Jul 2026 none MIT — Details →
0.106.40-alpha-20260717173123-0fdc1800aa1083a1c703a39b10032d1e368dc7e1 17 Jul 2026 none MIT — Details →
0.106.40-alpha-20260717164506-ed1dd6bd17dea43d111ee25d83098eeb428e670d 17 Jul 2026 none MIT — Details →
0.106.40-alpha-20260716192257-ac561f18e0b65b9a21e9ad7b2c765d47824193cb 16 Jul 2026 none MIT — Details →
0.106.40-alpha-20260714192817-638eb01123e53e79cfff7f7990ace2624a10f8af 14 Jul 2026 none MIT — Details →
0.106.40-alpha-20260714192752-9ab399a59ace869fe68d618da36a454cbe7cc70b 14 Jul 2026 none MIT — Details →
0.106.40-alpha-20260714110936-f73c27a6d3b4a1643fe76273acff8bed91fbcecc 14 Jul 2026 none MIT — Details →
0.106.40-alpha-20260714102813-2f6f3e0c5b2c6491711dd4be9c5683a33a377342 14 Jul 2026 none MIT — Details →
0.106.40-alpha-20260714101906-4e4a535df93c3dc39791e95678b6f40ff38080d7 14 Jul 2026 none MIT — Details →
0.106.40-alpha-20260713205255-b63cadc0fe02cb377fecc0d952ec86b8b212bb46 13 Jul 2026 none MIT — Details →
0.106.40-alpha-20260713205208-76adc0fe2d241b9f60fda2e53b06a7e7b6b21627 13 Jul 2026 none MIT — Details →
0.106.40-alpha-20260713204738-e1a51d5618e8231aa369e50eb0b867250375d34b 13 Jul 2026 none MIT — Details →
0.106.40-alpha-20260713204353-c5c670abda5295266c60e64aaff44e9fc8107765 13 Jul 2026 none MIT — Details →
0.106.40-alpha-20260711171741-7bfa1caca42955ec67ace35ae534c83fd292f50b 11 Jul 2026 none MIT — Details →
0.106.40-alpha-20260710150347-4aba64b37df65ba58421356dfc5d0fb4a09b074c 10 Jul 2026 none MIT — Details →
0.106.40-alpha-20260710133848-1c77a66b8230f1f4c296a35f0744488154ddcf43 10 Jul 2026 none MIT — Details →
0.106.40-alpha-20260709213953-10f357aa5b965e49403432e2412b3d9be79ef4e6 09 Jul 2026 none MIT — Details →
0.106.40-alpha-20260709213954-ca0b23145072d6fc92540000ac364a6bc4abe98e 09 Jul 2026 none MIT — Details →
0.106.40-alpha-20260708202332-95433cb32c74d97f6d906cf197dba9bccd3e0add 08 Jul 2026 none MIT — Details →
0.106.40-alpha-20260708193638-9cfb6b9b1284d1b7db0ad3c3f87ef43e45492f37 08 Jul 2026 none MIT — Details →
0.106.40-alpha-20260708193610-6b0963db457bcf907d6179236a852649f568e13b 08 Jul 2026 none MIT — Details →
0.106.40-alpha-20260708193540-96edbbe63b35b73de7c7fcd0095d55f86acedf72 08 Jul 2026 none MIT — Details →
0.106.40-alpha-20260707231825-2c153888eea14dd5b493f2192ae5f244aa8d0fed 07 Jul 2026 none MIT — Details →
0.106.40-alpha-20260707222236-ca58ffe5cce44872a8c12656de04aafb54f7cd2b 07 Jul 2026 none MIT — Details →
0.106.40-alpha-20260707211018-48567e174a4af0579a6376d3d348ac56c7c49a0e 07 Jul 2026 none MIT — Details →
0.106.40-alpha-20260707125606-9fadeac9987d0d83c97f96eb0ea2e51bb7ff5744 07 Jul 2026 none MIT — Details →
0.106.40-alpha-20260707125333-f1b9ee34bb3556dd962e3a2d0943c95987eddcbb 07 Jul 2026 none MIT — Details →
0.106.40-alpha-20260707124228-4cef11a0f0521fd092ee2a4f8796f48b4e5325f3 07 Jul 2026 none MIT — Details →
0.106.40-alpha-20260707124136-b2f69fa192dd429aa05669c57fffb81adbee1fb4 07 Jul 2026 none MIT — Details →
0.106.40-alpha-20260707123412-a9b022f679cbb1c4896821261d4d3d39d416ce89 07 Jul 2026 none MIT — Details →
0.106.40-alpha-20260707122638-206169596739fad771992a1e2b98bb72ebb508ae 07 Jul 2026 none MIT — Details →
0.106.40-alpha-20260707120709-d90613f6d390640dc3e43e297a275cad8aa683ba 07 Jul 2026 none MIT — Details →
0.106.40-alpha-20260707111600-5ff27d3b60cac6bb3c0adce0c3f4ff1a0d850477 07 Jul 2026 none — — Details →
0.106.40-alpha-20260707105311-607866ebaa624d64fd2bf840f142b7d2be2afe1b 07 Jul 2026 none — — Details →
0.106.40-alpha-20260706225705-836e49b8f6b0d133fc7e409a1e9864a81332ffed 06 Jul 2026 none — — Details →
0.106.40-alpha-20260706213037-5e96cc8b47d5968c22b9f6ccbde4393e06d117c8 06 Jul 2026 none — — Details →
0.106.40-alpha-20260706212247-099af2fe209fc4b698f9237f3416b9d128d2f173 06 Jul 2026 none — — Details →
0.106.40-alpha-20260706190503-cff35df9ca682b1cb060b49f37645863a6d889f2 06 Jul 2026 none — — Details →
0.106.40-alpha-20260703175531-6e193484e79e3b2827e5398f208e26402c1f03e5 03 Jul 2026 none — — Details →
0.106.40-alpha-20260703165845-6780d322ecc9c22c2ffa27afed2340fb3aaf31ac 03 Jul 2026 none — — Details →
0.106.40-alpha-20260703134151-277868da1faa093eb2df6d048c55d942a71732fd 03 Jul 2026 none — — Details →
0.106.40-alpha-20260703133208-99411957192950c9f30aaf69da00beb2f9f87191 03 Jul 2026 none — — Details →
0.106.40-alpha-20260703132612-515f21674de728caa4152e8429a5151ef092067e 03 Jul 2026 none — — Details →
0.106.40-alpha-20260703130747-ab9b6e650e1bd7fd0b2a96b2f7b8104d16681edb 03 Jul 2026 none — — Details →
0.107.0-alpha-20260703095244-14a30ee7156dc615346ba24cf9f7e9300a181877 03 Jul 2026 none — — Details →
0.106.40-alpha-20260702171909-2018c2057a65d400a51ad5bb66dab2157aece66b 02 Jul 2026 none — — Details →
0.106.40-alpha-20260702161236-ee0e491793b96522a4aa84b83f7dc39052ff45d1 02 Jul 2026 none — — Details →
0.106.40-alpha-20260702155900-87d5101eb01308a5ee3c0b030371becc38dc07ad 02 Jul 2026 none — — Details →
0.106.40-alpha-20260629184041-fb83450102ea4b288cf0dec2251b6033bdcd7fd0 29 Jun 2026 none — — Details →
0.106.40-alpha-20260628153431-856e70bd78d1025bdda43799f2133d5e1809c606 28 Jun 2026 none — — Details →
0.106.40-alpha-20260624185752-20036da6439f1ec3368d79b2170a1d7a35644018 24 Jun 2026 none — — Details →
0.106.40-alpha-20260615190110-72c60a3917decaba5253e81ca662913be2356ca4 15 Jun 2026 none — — Details →

The newest 120 of 4,482 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2023 1

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 0 of the 1 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for @graphql-mesh/runtime

The 1 most severe of 1 vulnerabilities recorded for this package

Search all 1 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
Cache variables with transforms vulnerability in @graphql-mesh/runtime 5.1 medium 0.96.9 10 Oct 2023

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About @graphql-mesh/runtime

Is @graphql-mesh/runtime safe to use?

Vulert records 1 vulnerabilities for @graphql-mesh/runtime in npm: 0 critical, 0 high, 1 medium and 0 low. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is @graphql-mesh/runtime's Vulert package health score?

Vulert scores @graphql-mesh/runtime 90/100, which reads as healthy. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of @graphql-mesh/runtime affected?

No. 0.109.3, the version you would install today, has no vulnerabilities on record against it. Earlier releases do — the version table above lists each release with what affects it.

How many vulnerabilities does @graphql-mesh/runtime have?

1 vulnerability is recorded for @graphql-mesh/runtime in the npm ecosystem: 0 critical, 0 high, 1 medium and 0 low. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new @graphql-mesh/runtime vulnerabilities disclosed?

0 vulnerabilities were recorded for @graphql-mesh/runtime in the last 12 months, and the oldest entry in this database dates to 10 Oct 2023. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of @graphql-mesh/runtime are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor @graphql-mesh/runtime for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the @graphql-mesh/runtime version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.