CVE-2026-114604 | Ardatan graphql-tools up to 12.0.1 setObjectKeyPath mergeIncrementalResult.ts mergeIncrementalResult path prototype pollution

October 22, 2026 Yanac

A vulnerability labeled as critical has been found in Ardatan graphql-tools up to 12.0.1. The impacted element is the function mergeIncrementalResult of the file packages/utils/src/mergeIncrementalResult.ts of the component setObjectKeyPath. Executing a manipulation of the argument path can lead to improperly controlled modification of object prototype attributes.

The identification of this vulnerability is CVE-2026-114604. The attack may be launched remotely. There is no exploit available.

The affected component should be upgraded.VulDB Recent EntriesRead More