Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2025-32030: Apollo Gateway can use excessive resources with crafted queries
CVE-2025-32030 · published 1 year ago
Summary
The Apollo Gateway component that merges multiple GraphQL services can be forced to work extremely hard when a query repeats the same parts many times. This can consume a lot of CPU and memory, slowing or stopping the service. Update the gateway to version 2.10.1 or later to prevent the issue.
What to do
- Update apollo gateway to version 2.10.1.
- Update apollo @apollo/gateway to version 2.10.1-aikido.1.
- Update rootio @rootio/apollo__gateway to version 2.10.1-root.io.1.
- Update apollographql apollo_gateway to version 2.10.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | apollo | gateway |
< 2.10.1 Fix: upgrade to 2.10.1
|
| – | apollographql | apollo_gateway |
< 2.10.1 cpe:2.3:a:apollographql:apollo_gateway:*:*:*:*:*:node.js:*:* |
| Root:npm | apollo | @apollo/gateway |
< 2.10.1-aikido.1 Fix: upgrade to 2.10.1-aikido.1
|
| Root:npm | rootio | @rootio/apollo__gateway |
< 2.10.1-root.io.1 Fix: upgrade to 2.10.1-root.io.1
|
Original advisory text
Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion
Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to 2.10.1, a vulnerability in Apollo Gateway allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically during named fragment expansion. Named fragments were being expanded once per fragment spread during query planning, leading to exponential resource usage when deeply nested and reused fragments were involved. This could lead to excessive resource consumption and denial of service. This has been remediated in @apollo/gateway version 2.10.1.
References
- https://github.com/advisories/GHSA-q2f9-x4p4-7xmh
- https://github.com/apollographql/federation/releases/tag/%40apollo%2Fgateway%402... URL
- https://github.com/apollographql/federation/security/advisories/GHSA-q2f9-x4p4-7... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32030... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-32030 Vendor Advisory
- https://github.com/apollographql/federation/pull/3236 Patch
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published7 Apr 2025
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta