CVE-2026-114604: GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

mergeIncrementalResult merges an incremental GraphQL response part into an accumulated execution result by walking ['data', ...incrementalResult.path] and assigning at the resolved location. setObjectKeyPath tries to reject dangerous segments with strict string equality against '__proto__', 'constructor' and 'prototype' (lines 50-52 and 60-62), but it never validates that a path segment is a primitive string or number. A JSON path segment such as ["__proto__"] is an array object, so ["__proto__"] !== '__proto__' and the guard passes; the very next statement does current[key], whose ToPropertyKey coercion turns that array into the string key "__proto__" and resolves Object.prototype. The following, innocuous-looking segment is then assigned directly onto Object.prototype.

In a consuming app, incrementalResult is the response part being merged — data parsed from an upstream @defer/@stream multipart or incremental-delivery response from another GraphQL server or transport. The ExecutionResult TypeScript annotation is not a runtime check, so a malicious, compromised, or MITM’d upstream can choose the path value and therefore choose global prototype keys and values in the gateway or client process.

Comparable paths through the same helper, for contrast:

• Plain string segment "__proto__" -> blocked by strict equality, lines 50-52 (confirmed by a control case in testing)
• Array segment ["__proto__"] -> unsafe: passes the guard at lines 50-52, then coerced to the __proto__ key at lines 53-57
• Same operation in 10.10.0 and earlier, which used dset -> not exploitable (0/5 attack payloads succeeded)