Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.2

Apollo Next.js support may run malicious code

CVE-2024-23841 · published 2 years ago
Summary

The @apollo/experimental-nextjs-app-support package used with Next.js can allow attackers to inject harmful scripts that run in a user’s browser. This can happen if a user follows a crafted link or if malicious data is stored and returned by a GraphQL server. Update the package to version 0.7.0 or newer to stop this risk.

What to do
  • Update apollo experimental-nextjs-app-support to version 0.7.0.
  • Update apollographql apollo_client to version 0.7.0 or later.
Affected software
Ecosystem VendorProductAffected versions
npm apollo experimental-nextjs-app-support <= 0.6.0
Fix: upgrade to 0.7.0
– apollographql apollo_client < 0.7.0
cpe:2.3:a:apollographql:apollo_client:*:*:*:*:*:node.js:*:*
Original advisory text
XSS in @apollo/experimental-nextjs-app-support
apollo-client-nextjs is the Apollo Client support for the Next.js App Router. The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this vulnerability, an attacker would need to either inject malicious input (e.g. by redirecting a user to a specifically-crafted link) or arrange to have malicious input be returned by a GraphQL server (e.g. by persisting it in a database). To fix this issue, please update to version 0.7.0 or later.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
8.2 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-80Basic XSS
Timeline
Published30 Jan 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-rv8p-rr2h-fgpg · GHSA
CVE-2024-23841 · NVD
CVE-2024-23841 · OSV
Track software like this
Free during beta