CVE-2025-27097: GraphQL Mesh Information Disclosure Flaw

CVE-2025-27097 Overview

CVE-2025-27097 affects GraphQL Mesh, a federation framework and gateway used to compose GraphQL Federation subgraphs, non-GraphQL services such as REST and gRPC, and databases including MongoDB, MySQL, and PostgreSQL. The vulnerability stems from how the gateway caches DocumentNode objects when transforms are applied at the root level or to a single source. When clients send the same query with different variables, the gateway reuses the original variables from the cached document until the LRU eviction policy removes the entry. If a token is passed as a variable, subsequent requests execute under the prior token, leading to a short-lived memory leak and potential cross-request data exposure.

Critical Impact

Authentication tokens or sensitive parameters passed as GraphQL variables can be reused across requests, allowing operations to execute under unintended credentials until cache eviction.

Affected Products

• the-guild GraphQL Mesh 0.96.5
• the-guild GraphQL Mesh 0.96.6
• the-guild GraphQL Mesh 0.96.7
• the-guild GraphQL Mesh 0.96.8

Discovery Timeline

• 2025-02-20 - CVE-2025-27097 published to NVD
• 2025-02-27 - Last updated in NVD database

Technical Details for CVE-2025-27097

Vulnerability Analysis

GraphQL Mesh caches parsed DocumentNode instances to avoid re-parsing identical query strings. When transforms are applied at the root level or to a single source, the cached document retains the variable values from the first request that populated the cache entry. Subsequent requests using the same query string but different variables receive the same cached document with the original variable bindings. The runtime executes the operation using stale variables rather than the new ones supplied by the client. The cache only evicts entries through its least recently used (LRU) policy, so the stale binding can persist across many requests.

The issue maps to CWE-400 (Uncontrolled Resource Consumption) and CWE-401 (Missing Release of Memory after Effective Lifetime). The advisory describes a bounded memory leak that grows per distinct operation rather than per request.

Root Cause

The transform pipeline binds variables to the cached DocumentNode instead of treating variables as request-scoped inputs. The cache key incorporates the operation but not the variable set, so different variable payloads collide on the same cached entry.

Attack Vector

Exploitation requires network access to a GraphQL Mesh endpoint and authenticated client interaction. An authenticated user submitting an operation that another client previously executed can receive responses processed under the previous client's variable values, including any token passed through variables. The condition is triggered by normal client traffic and does not require crafted payloads.

The vulnerability is a GraphQL API logic flaw. No exploitation code or public proof-of-concept is referenced in the advisory.

Detection Methods for CVE-2025-27097

Indicators of Compromise

• Unexpected access to data that does not match the authenticated principal's token, observed in audit logs of upstream services fronted by GraphQL Mesh.
• Sustained heap growth in GraphQL Mesh Node.js processes correlated with high cardinality of distinct operations.
• Backend services receiving requests with tokens that do not match the originating client session.

Detection Strategies

• Inventory deployed GraphQL Mesh installations and compare versions against the affected range 0.96.5 through 0.96.8.
• Inspect mesh configuration files for root-level transforms or single-source transforms, which are the configurations that trigger the unsafe caching path.
• Correlate GraphQL operation logs with upstream authentication logs to identify requests executing under the wrong token.

Monitoring Recommendations

• Enable structured logging on the gateway and forward GraphQL operation traces, variable hashes, and resolved identity claims to a centralized analytics platform.
• Track Node.js process memory metrics for gateways using transforms and alert on monotonic growth between LRU eviction cycles.
• Audit upstream service logs for token reuse anomalies across distinct client sessions.

How to Mitigate CVE-2025-27097

Immediate Actions Required

• Upgrade GraphQL Mesh to a release later than 0.96.8 that includes the fix referenced in the GitHub Security Advisory.
• Stop passing authentication tokens, session identifiers, or tenant identifiers through GraphQL variables. Pass them in HTTP headers handled outside the cached DocumentNode scope.
• Review and tighten root-level and single-source transform configurations until the patched version is deployed.

Patch Information

The vendor published remediation guidance in the GraphQL Mesh GitHub Security Advisory GHSA-rr4x-crhf-8886. Upgrade to a fixed release and validate that transforms operate against request-scoped variables after deployment.

Workarounds

• Remove root-level transforms and consolidate transforms into per-resolver or per-subgraph scopes that do not share the affected cache path.
• Move sensitive values from GraphQL variables into HTTP headers and propagate them via context rather than through cached document parameters.
• Reduce the LRU cache size to shorten the window during which stale variable bindings persist, accepting the parsing cost as a temporary trade-off.

# Upgrade GraphQL Mesh to a patched release
npm install @graphql-mesh/serve-cli@latest
npm ls | grep graphql-mesh