CVE-2025-32034: Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion
(updated )
A vulnerability in Apollo Router allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically during named fragment expansion. This could lead to excessive resource consumption and denial of service.
References
- github.com/advisories/GHSA-75m2-jhh5-j5g2
- github.com/apollographql/router
- github.com/apollographql/router/commit/ab6675a63174715ea6ff50881fc957831d4e9564
- github.com/apollographql/router/commit/bba032e183b861348a466d3123c7137a1ae18952
- github.com/apollographql/router/security/advisories/GHSA-75m2-jhh5-j5g2
- nvd.nist.gov/vuln/detail/CVE-2025-32034
Code Behaviors & Features
Detect and mitigate CVE-2025-32034 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →