VulertSecurity VulertSecurity

Vulnerability Database · npm · Package report

@graphql-tools/utils: vulnerability history, versions and safety

@graphql-tools/utils is a package in the npm ecosystem. Vulert records 2 vulnerabilities for it across 8 releases, first recorded in Oct 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
2 vulnerabilities recorded H2
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
2 in the last 12 months

Most recent disclosure 22 Oct 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all @graphql-tools/utils vulnerabilities

Vulert verdict on @graphql-tools/utils 13.1.2 i

Updated on 23 Oct 2026

Good news: 13.1.2, the version you would install today, has no known vulnerabilities. Older releases do — the table below lists all 2.

Package health score 80/100
  • Security Minor issues
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Moderate

What to do: Stay on 13.1.2 or newer. This can change: a vulnerability disclosed tomorrow can affect 13.1.2 too — Vulert watches the package and alerts you if that happens. Monitor it with Vulert →

  • Current release 13.1.2 — unaffected i
  • Vulnerabilities on record 2 over 1 year · 2 in the last year i
  • Latest disclosure 22 Oct 2026 i
  • Highest CVSS 8.4 i
  • With no published fix 0 i
  • Stars 5,431 i
  • OpenSSF scorecard 4/10 i
  • Last release this month i
  • Licence MIT i

Version list, release dates, licence and dependants published by the npm registry, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for @graphql-tools/utils, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
13.1.3-alpha-20261022142622-fbb7026d75d092d5b129d7d0a8dcbbe6c0b54f93 22 Oct 2026 none MIT — Details →
13.1.3-alpha-20261022141031-91c83c5bb61dab256d9a12a1300ffec2d191bf8c 22 Oct 2026 none MIT — Details →
13.1.3-alpha-20261022140928-528a5e32ae5a09b1be6b761fa9a78ecdc6cbf39b 22 Oct 2026 none MIT — Details →
13.1.3-alpha-20261022140714-a514d141efb7db11d555cc3c5ad18c3d1bba539f 22 Oct 2026 none MIT — Details →
13.1.3-alpha-20261022140540-3704d277c1efd329b9b8636e28ca4f8240d825da 22 Oct 2026 none MIT — Details →
13.1.3-alpha-20261022140043-399fc2d11384e346cdd63b9dbdad8ba2c83054fc 22 Oct 2026 none MIT — Details →
13.1.3-alpha-20261022135503-8d55700d2189976c47709ae310e7a93c48fb336b 22 Oct 2026 none MIT — Details →
13.1.3-alpha-20261022135312-6f7261c885ae270cd82e1bdbf39099774bb70e42 22 Oct 2026 none MIT — Details →
13.1.3-alpha-20261022134929-fcdf7790e25bf34e6d7c080ca82ea7e09a1e1225 22 Oct 2026 none MIT — Details →
13.1.2-alpha-20261022112046-2a1d6e720c9620bbdd1b59723254c9a9a34057bc 22 Oct 2026 none MIT — Details →
13.1.2-alpha-20261022112259-8ea91b5c906c81dcb5ca4bb34f08157cf8eaba9b 22 Oct 2026 none MIT — Details →
13.1.2 22 Oct 2026 none MIT — Details →
13.1.2-rc-20261022111714-676b1df2e70279f406beea4c1ffc473e1bce2177 22 Oct 2026 none MIT — Details →
13.1.2-alpha-20261021144100-47631ff1487f2285e227b84c072ae84f30a23adb 21 Oct 2026 none MIT — Details →
13.1.2-alpha-20261021142241-5f7ed6631dc34bbfaf734b2d1e50982f4a62e73b 21 Oct 2026 none MIT — Details →
13.1.2-alpha-20261021141955-a293ecf70e7c9f2b8d4b9bebaa203ca6c58b7f49 21 Oct 2026 none MIT — Details →
13.1.2-alpha-20261021141728-736a4ae7b3c1169c62e2db9f2ed4ed77979bf08c 21 Oct 2026 none MIT — Details →
13.1.1 20 Oct 2026 none MIT — Details →
13.1.1-rc-20261020151036-747d284a4a47c0c02af2bea075268c2289f8b758 20 Oct 2026 none MIT — Details →
13.1.1-alpha-20261020145640-df200f6f51e88edd06580abbfe97ddf13c457fdd 20 Oct 2026 none MIT — Details →
13.1.1-alpha-20261020145849-20902ff7ec3c65eafe707be10e42b5346dd166ea 20 Oct 2026 none MIT — Details →
13.1.1-alpha-20261020145425-218968199939b10f1ca9458c5ecf1024b7600ace 20 Oct 2026 none MIT — Details →
13.1.1-alpha-20261020145141-5d888f11bdbd1a5cf81f867c98be331ea5dda527 20 Oct 2026 none MIT — Details →
13.1.0 20 Oct 2026 none MIT — Details →
13.1.0-alpha-20261020141638-679c53effb1d84578dfdb8cd2fbcd0c4c93d970e 20 Oct 2026 none MIT — Details →
13.1.0-alpha-20261020141228-0b45c008c3eb39b6b634293732537f794bfeef17 20 Oct 2026 none MIT — Details →
13.1.0-alpha-20261020140849-f7e5a30e007407cc310c6a4078176c49831b90b5 20 Oct 2026 none MIT — Details →
13.0.2 19 Oct 2026 none MIT — Details →
13.0.1-alpha-20261019174411-2721b4ef3fa91039752c353b6827f98d0e7bb011 19 Oct 2026 none MIT — Details →
13.0.1-alpha-20261019174158-8ac7bf6549b1cf4b9fc6834285586705c269c47f 19 Oct 2026 none MIT — Details →
13.0.1 19 Oct 2026 none MIT — Details →
13.0.1-rc-20261019170803-add3b34f4e88e57240f6192c9524544f9254613f 19 Oct 2026 none MIT — Details →
13.0.1-alpha-20261019170158-4f56910b5e58e3911a3b63cdaa86fbbf80c26cff 19 Oct 2026 none MIT — Details →
13.0.1-rc-20261019170540-d3207f83edd1af7cc18b1d0de87e76ca21a22a09 19 Oct 2026 none MIT — Details →
13.0.1-alpha-20261019165808-aa414154104f0ba58c06e0f64fdab7429a9a5303 19 Oct 2026 none MIT — Details →
13.0.1-alpha-20261019165722-e6efc1d26103633c70a90fe4c88d2b5e701525a2 19 Oct 2026 none MIT — Details →
13.0.1-alpha-20261019165600-ad37ff70135b08e4e529bb9774dbafc92c0afafd 19 Oct 2026 none MIT — Details →
13.0.1-alpha-20261019165313-ce89507f1f0bf61cbfbf6dbd63cc428e18d474c9 19 Oct 2026 none MIT — Details →
13.0.1-alpha-20261019164611-538e7787be9cdbcfc800aa118defd976f702b538 19 Oct 2026 none MIT — Details →
13.0.0 19 Oct 2026 none MIT — Details →
13.0.0-rc-20261019143444-08495dac9c78ba1d624dc02ca6dcaeca82aaf318 19 Oct 2026 none MIT — Details →
13.0.0-alpha-20261019142930-3ab3ca203e89678c45cece760eab3cefb7bb23fc 19 Oct 2026 none MIT — Details →
13.0.0-alpha-20261019143118-7be5ebb61649aab8d773143666a8b71acf0aab42 19 Oct 2026 none MIT — Details →
13.0.0-alpha-20261019142605-31a7d24a74197583275edd80d719303efbab526c 19 Oct 2026 none MIT — Details →
13.0.0-alpha-20261019142441-78363a692cf433b8d5b385337ee3aebc8dc6a8f6 19 Oct 2026 none MIT — Details →
13.0.0-alpha-20261019142107-6fe6d688eee4ecefb44cb34f332037ccd6460b29 19 Oct 2026 none MIT — Details →
13.0.0-alpha-20261019141549-ff80c5f2e15200356b0aa18db148f5cb87df43a2 19 Oct 2026 none MIT — Details →
13.0.0-alpha-20261019140756-1812de5350d5e87b1e769072da936cdcde58a768 19 Oct 2026 none MIT — Details →
13.0.0-alpha-20261019140549-83ff9b0d91ccc5771770665e9a5f83332f82fc27 19 Oct 2026 none MIT — Details →
13.0.0-alpha-20261019132510-84a464bc30031a63612acebe95c678a0ea62d7a0 19 Oct 2026 none MIT — Details →
13.0.0-alpha-20261019132215-d30f3aa15d60aae255d10b9bc6bc788fcee00b8b 19 Oct 2026 none MIT — Details →
13.0.0-alpha-20261019132402-30fc0b7853ca366ec00b25af2a46124fb5b821d9 19 Oct 2026 none MIT — Details →
13.0.0-alpha-20261019132350-c3868a7780411bb0ade96eae9d7f0ff2f9c966b9 19 Oct 2026 none MIT — Details →
13.0.0-alpha-20261019132037-2dcfc01711b2a1eabb5e86babdd857bee5a15e2f 19 Oct 2026 none MIT — Details →
13.0.0-alpha-20261019132215-251cf5c8bcdccd2a02d3f221afdef52d109a3ecb 19 Oct 2026 none MIT — Details →
13.0.0-alpha-20261019132106-3740a8824447f2af018fcc915c2f811e833d846b 19 Oct 2026 none MIT — Details →
13.0.0-alpha-20261017153408-5c280da98a0fd8acd4c58da44213fdb0fbc3d7d6 17 Oct 2026 none MIT — Details →
13.0.0-alpha-20261017152910-a1160dd9f64eff0e9abf9b66ce651c1d3717f685 17 Oct 2026 none MIT — Details →
13.0.0-alpha-20261017151025-e528c7e870bacb53796ac7d2691c0896c632cffb 17 Oct 2026 none MIT — Details →
13.0.0-alpha-20261016110610-2cf008e0d40094a9a735a16a849dfb60589da957 16 Oct 2026 none MIT — Details →
13.0.0-alpha-20261015220015-2b402d9ad6308ef8eee2c46d885ed0b3f5cf05ff 15 Oct 2026 none MIT — Details →
13.0.0-alpha-20261015215157-a21f8cbf8d73f80c4c97abb44b097a74a6977287 15 Oct 2026 none MIT — Details →
13.0.0-alpha-20261015185255-f2057a0e2a0bf449d59e2b61db74f4a0e83e9181 15 Oct 2026 none MIT — Details →
13.0.0-alpha-20261015175058-9ecfc251488d852a7bcb1dc5a5d37e83700c57b9 15 Oct 2026 none MIT — Details →
13.0.0-alpha-20261015164831-3b172fbf53a58da52a4b15c8b8576ff6f5ca0f97 15 Oct 2026 none MIT — Details →
13.0.0-alpha-20261015162433-e99452262a3e83baf5b44a93625d31c45d5bbe1f 15 Oct 2026 none MIT — Details →
13.0.0-alpha-20261015162601-f86bde78972a59254d9b99f7a8fbf10a7466ddb7 15 Oct 2026 none MIT — Details →
13.0.0-alpha-20261015161426-4fe867d57cda1b730cfe517957106c5af9c0307f 15 Oct 2026 none MIT — Details →
13.0.0-alpha-20261015161145-50dfded556dbaeb84995501b7993869b764c1fe7 15 Oct 2026 none MIT — Details →
13.0.0-alpha-20261015160958-68fe6fdf8d857b238f40fbf8008c052aac130fb6 15 Oct 2026 none MIT — Details →
13.0.0-alpha-20261015155046-d7c89c4fdf1f73dcedcb0a0bea91d3b62e80193f 15 Oct 2026 none MIT — Details →
13.0.0-alpha-20261015153440-51428b9a35d7b6059a68e83dd12de91f0c1cba5e 15 Oct 2026 none MIT — Details →
13.0.0-alpha-20261015153019-85954e35ab9c9dfe5650572fda19dc3df4179b0b 15 Oct 2026 none MIT — Details →
13.0.0-alpha-20261015151940-b99f8aefa475bd4e39ca13c9cd6cccfc46c78480 15 Oct 2026 none MIT — Details →
13.0.0-alpha-20261015151809-886b87bbcc98b0bd0e9ba2efabf169b52bfcff5d 15 Oct 2026 none MIT — Details →
13.0.0-alpha-20261015151621-1c4025460404f1dd12cdb49ab54e62f79c49046a 15 Oct 2026 none MIT — Details →
13.0.0-alpha-20261015151226-5868300779ac4a46f260b4a5fd3fd669c4d7cba8 15 Oct 2026 none MIT — Details →
12.1.0 15 Oct 2026 none MIT — Details →
12.1.0-rc-20261015131120-fa97ce503c5733b9c54c9bf11d9ecfe4138ed20c 15 Oct 2026 none MIT — Details →
12.1.0-alpha-20261015130915-916dd91b21012b0b76097fea698178038cf88047 15 Oct 2026 none MIT — Details →
12.1.0-alpha-20261015125059-94858f8ca46477dd359666d879cf6dea1e3c4e68 15 Oct 2026 none MIT — Details →
12.0.5-alpha-20261015123110-f35fb24c2020f3608e12004cbe07375e3cdcce02 15 Oct 2026 none MIT — Details →
12.0.5-alpha-20261015121728-a889a3a505227bcb95b3859a6621084522332686 15 Oct 2026 none MIT — Details →
12.0.5-alpha-20261015120504-12ef6e15bdf398bfc67c5b483b142ebe17df676b 15 Oct 2026 none MIT — Details →
12.0.5-alpha-20261015115653-8859b08713091dbed7e7f72201b14c991d3fe4b4 15 Oct 2026 none MIT — Details →
12.0.5-alpha-20261015115322-da8ab0313af1fc687fe27e11377fb33759431f6f 15 Oct 2026 none MIT — Details →
12.0.5-alpha-20261015113541-c8da89ad5a264659c870cb3ef894501fe5b30705 15 Oct 2026 none MIT — Details →
12.1.0-alpha-20261015113511-9a01fb5da2863f3accab89004ca9fea2d754b8ac 15 Oct 2026 none MIT — Details →
12.0.5-alpha-20261015112432-7416a243efcc18c955e70c48b6aaf529eee1e555 15 Oct 2026 none MIT — Details →
12.1.0-alpha-20261015112416-a00b7382039a493dd54c396b228f4bddfc63ce0f 15 Oct 2026 none MIT — Details →
12.0.5-alpha-20261015112048-d288fc5c7bf2b3463282a3ecbc8c448d6f274fe5 15 Oct 2026 none MIT — Details →
12.0.5-alpha-20261015111704-0a6dbc407a8f68de12c48b6b770598d43a8641c1 15 Oct 2026 none MIT — Details →
12.0.5-alpha-20261015111432-738406381e13628fc2d29c3573e0bc3430f47e86 15 Oct 2026 none MIT — Details →
12.0.5-alpha-20261015110519-dc73e86563917132c2b24129d12cae1e24003c7e 15 Oct 2026 none MIT — Details →
12.1.0-alpha-20261015110443-8e2c4e6197462e9a4e62cb5b52e5c7d767ec895f 15 Oct 2026 none MIT — Details →
12.0.5-alpha-20261015105813-7dcc5f2faa696fbd8916d6d8fd0aab29b23fd026 15 Oct 2026 none MIT — Details →
12.0.5-alpha-20261015105344-2b8fd0dd346ab3ef2b57a5770a98bc4494340cc2 15 Oct 2026 none MIT — Details →
12.0.5-alpha-20261015104330-cfe35733f8b9dd4cc717693fe6eb133932dd86f2 15 Oct 2026 none MIT — Details →
12.0.5-alpha-20261015102510-4f2893fe28e5054181f8580d6de89e78ec2d1ab1 15 Oct 2026 none MIT — Details →
12.0.5-alpha-20261015102120-98b4ac064ad30608549882d0ea39e9767a7ffe47 15 Oct 2026 none MIT — Details →
12.0.5-alpha-20261015093445-21fd7e797a8d53116a5d5116614a1626b7005672 15 Oct 2026 none — — Details →
12.0.5-alpha-20261015092807-a021b97f118ca519e176ca16da05244a1fcb1d9e 15 Oct 2026 none — — Details →
12.0.5-alpha-20261015084620-a021b97f118ca519e176ca16da05244a1fcb1d9e 15 Oct 2026 none — — Details →
12.0.5-alpha-20261015070549-9c2fe41d763c1603a887baee50605fff92d91969 15 Oct 2026 none — — Details →
12.0.4 12 Oct 2026 none — — Details →
12.0.4-alpha-20261012125558-33625d2bc71b573c8b63d48f8a3868d616c1f343 12 Oct 2026 none — — Details →
12.0.4-alpha-20261012124749-c550474c90d51ae956296d0a54ffa999a6029a31 12 Oct 2026 none — — Details →
12.1.0-alpha-20261001172002-43a3bfc038b85ab2a63e666c2974f904fbe6fd5f 01 Oct 2026 none — — Details →
12.0.3 30 Sep 2026 none — — Details →
12.0.3-alpha-20260930220303-8c8dbc8336baefee6d3a6f66cc117afc1f5b717b 30 Sep 2026 none — — Details →
12.0.3-alpha-20260930215632-5cb842eb6a4dae701e10ec6e3fc7631675cca52f 30 Sep 2026 none — — Details →
12.0.2 30 Sep 2026 none — — Details →
12.0.2-alpha-20260930213106-001ad6da4923b8bb612d81d5418e51f7365e603b 30 Sep 2026 H1 — Yes Details →
12.0.2-alpha-20260930212608-611af4b453fbbc455daaa1db7deed44c1ae9a1ca 30 Sep 2026 H1 — Yes Details →
12.0.2-alpha-20260930211553-6f1dc9e9e45d4cdde63e6623831d6943f46cb445 30 Sep 2026 H1 — Yes Details →
12.0.2-alpha-20260930211155-5f318fe81fe60941dbf532dfc28ea6e51cb8200b 30 Sep 2026 H1 — Yes Details →
12.0.2-alpha-20260930210636-7a7c806fbd6f1bac99f93d645a8acfe227bcb028 30 Sep 2026 H1 — Yes Details →
12.0.2-alpha-20260930210003-20283eef0f6f637e6836ba047ad95228c10cbcc1 30 Sep 2026 H1 — Yes Details →
12.0.2-alpha-20260930174405-35c8e26719dafe91a47248e4d634964a795f890a 30 Sep 2026 H1 — Yes Details →
12.0.2-alpha-20260930174435-fec342e19350b2df3d97471a412dc448e7580e4c 30 Sep 2026 H1 — Yes Details →

The newest 120 of 1,901 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2026 2

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 2 of the 2 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for @graphql-tools/utils

The 2 most severe of 2 vulnerabilities recorded for this package

Search all 2 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2026-114604: Prototype pollution in @graphql-tools/utils incremental result merging 8.4 high 12.0.2 22 Oct 2026
CVE-2026-104852: @graphql-tools/utils Prototype Pollution Vulnerability 8.2 high 12.0.1 05 Oct 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About @graphql-tools/utils

Is @graphql-tools/utils safe to use?

Vulert records 2 vulnerabilities for @graphql-tools/utils in npm: 0 critical, 2 high, 0 medium and 0 low. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is @graphql-tools/utils's Vulert package health score?

Vulert scores @graphql-tools/utils 80/100, which reads as in good shape. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of @graphql-tools/utils affected?

No. 13.1.2, the version you would install today, has no vulnerabilities on record against it. Earlier releases do — the version table above lists each release with what affects it.

How many vulnerabilities does @graphql-tools/utils have?

2 vulnerabilities are recorded for @graphql-tools/utils in the npm ecosystem: 0 critical, 2 high, 0 medium and 0 low. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new @graphql-tools/utils vulnerabilities disclosed?

2 vulnerabilities were recorded for @graphql-tools/utils in the last 12 months, and the oldest entry in this database dates to 05 Oct 2026. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of @graphql-tools/utils are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor @graphql-tools/utils for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the @graphql-tools/utils version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.