CVE-2025-27097

GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. When a user transforms on the root level or single source with transforms, and the client sends the same query with different variables, the initial variables are used in all following requests until the cache evicts DocumentNode. If a token is sent via variables, the following requests will act like the same token is sent even if the following requests have different tokens. This can cause a short memory leak but it won't grow per each request but per different operation until the cache evicts DocumentNode by LRU mechanism.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/ardatan/graphql-mesh/security/advisories/GHSA-rr4x-crhf-8886	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:the-guild:graphql_mesh:0.96.5:::::node.js::
	cpe:2.3:a:the-guild:graphql_mesh:0.96.6:::::node.js::
	cpe:2.3:a:the-guild:graphql_mesh:0.96.7:::::node.js::
	cpe:2.3:a:the-guild:graphql_mesh:0.96.8:::::node.js::

History

27 Feb 2025, 20:18

Type	Values Removed	Values Added
References	~~() https://github.com/ardatan/graphql-mesh/security/advisories/GHSA-rr4x-crhf-8886 -~~	() https://github.com/ardatan/graphql-mesh/security/advisories/GHSA-rr4x-crhf-8886 - Vendor Advisory
CPE		cpe:2.3:a:the-guild:graphql_mesh:0.96.5:::::node.js:: cpe:2.3:a:the-guild:graphql_mesh:0.96.6:::::node.js:: cpe:2.3:a:the-guild:graphql_mesh:0.96.8:::::node.js:: cpe:2.3:a:the-guild:graphql_mesh:0.96.7:::::node.js::
First Time		The-guild The-guild graphql Mesh
Summary		(es) GraphQL Mesh es un framework de trabajo y una puerta de enlace de GraphQL Federation para GraphQL Federation y subgrafos que no son de GraphQL Federation, servicios que no son de GraphQL, como REST y gRPC, y también bases de datos como MongoDB, MySQL y PostgreSQL. Cuando un usuario realiza una transformación en el nivel superusuario o en una única fuente con transformaciones, y el cliente envía la misma consulta con diferentes variables, las variables iniciales se utilizan en todas las solicitudes siguientes hasta que la memoria caché expulsa a DocumentNode. Si se envía un token a través de variables, las solicitudes siguientes actuarán como si se enviara el mismo token, incluso si las solicitudes siguientes tienen tokens diferentes. Esto puede provocar una breve pérdida de memoria, pero no aumentará con cada solicitud, sino con cada operación diferente hasta que la memoria caché expulse a DocumentNode mediante el mecanismo LRU.
CWE		CWE-401
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5

20 Feb 2025, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-02-20 21:15

Updated : 2025-02-27 20:18

NVD link : CVE-2025-27097

Mitre link : CVE-2025-27097

CVE.ORG link : CVE-2025-27097

JSON object : View

Products Affected

the-guild

graphql_mesh

CWE

CWE-400

Uncontrolled Resource Consumption

CWE-401

Missing Release of Memory after Effective Lifetime

{"id": "CVE-2025-27097", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-02-20T21:15:26.227", "references": [{"url": "https://github.com/ardatan/graphql-mesh/security/advisories/GHSA-rr4x-crhf-8886", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-401"}]}], "descriptions": [{"lang": "en", "value": "GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. When a user transforms on the root level or single source with transforms, and the client sends the same query with different variables, the initial variables are used in all following requests until the cache evicts DocumentNode. If a token is sent via variables, the following requests will act like the same token is sent even if the following requests have different tokens. This can cause a short memory leak but it won't grow per each request but per different operation until the cache evicts DocumentNode by LRU mechanism."}, {"lang": "es", "value": "GraphQL Mesh es un framework de trabajo y una puerta de enlace de GraphQL Federation para GraphQL Federation y subgrafos que no son de GraphQL Federation, servicios que no son de GraphQL, como REST y gRPC, y tambi\u00e9n bases de datos como MongoDB, MySQL y PostgreSQL. Cuando un usuario realiza una transformaci\u00f3n en el nivel superusuario o en una \u00fanica fuente con transformaciones, y el cliente env\u00eda la misma consulta con diferentes variables, las variables iniciales se utilizan en todas las solicitudes siguientes hasta que la memoria cach\u00e9 expulsa a DocumentNode. Si se env\u00eda un token a trav\u00e9s de variables, las solicitudes siguientes actuar\u00e1n como si se enviara el mismo token, incluso si las solicitudes siguientes tienen tokens diferentes. Esto puede provocar una breve p\u00e9rdida de memoria, pero no aumentar\u00e1 con cada solicitud, sino con cada operaci\u00f3n diferente hasta que la memoria cach\u00e9 expulse a DocumentNode mediante el mecanismo LRU."}], "lastModified": "2025-02-27T20:18:12.583", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:the-guild:graphql_mesh:0.96.5:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "BE510785-F022-4152-8536-1322352F0698"}, {"criteria": "cpe:2.3:a:the-guild:graphql_mesh:0.96.6:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "2D484264-71CC-4CFC-8959-FC43C8E44D5D"}, {"criteria": "cpe:2.3:a:the-guild:graphql_mesh:0.96.7:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "42D32CD2-98C5-49CB-A66E-F9F72F560073"}, {"criteria": "cpe:2.3:a:the-guild:graphql_mesh:0.96.8:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "B077BCC7-800F-43F3-AB05-6F7B3C05F0AA"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}

7.5 /10