CVE-2026-23897: Apollo Server DoS Vulnerability

CVE-2026-23897 Overview

Apollo Server, an open-source, spec-compliant GraphQL server compatible with any GraphQL client including Apollo Client, contains a Denial of Service (DoS) vulnerability in its startStandaloneServer functionality. The default configuration is vulnerable to resource exhaustion attacks through specially crafted request bodies using exotic character set encodings. This vulnerability specifically affects direct usage of startStandaloneServer from @apollo/server/standalone and does not impact users leveraging Apollo Server through integration packages such as @as-integrations/express5 or @as-integrations/next.

Critical Impact

Attackers can remotely trigger denial of service conditions against Apollo Server instances using the standalone configuration, potentially causing service disruption without requiring authentication.

Affected Products

• Apollo Server versions 2.0.0 to 3.13.0
• Apollo Server versions 4.2.0 to before 4.13.0
• Apollo Server versions 5.0.0 to before 5.4.0

Discovery Timeline

• 2026-02-04 - CVE CVE-2026-23897 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-23897

Vulnerability Analysis

This vulnerability stems from improper handling of Content-Type header character set encodings in the startStandaloneServer implementation. When processing incoming HTTP requests, the server fails to properly validate and sanitize exotic or malformed character set encodings specified in the request body's Content-Type header. This oversight allows attackers to craft requests that trigger inefficient regular expression processing patterns, leading to catastrophic backtracking scenarios that consume excessive CPU resources.

The weakness is classified as CWE-1333 (Inefficient Regular Expression Complexity), indicating that the underlying issue involves regex operations that can be exploited to cause algorithmic complexity attacks. By sending multiple concurrent requests with carefully constructed character set parameters, an attacker can effectively exhaust server resources and render the GraphQL endpoint unavailable to legitimate users.

Root Cause

The root cause lies in the body-parser middleware configuration within startStandaloneServer that processes incoming request bodies without adequate Content-Type parsing validation. Prior to the patch, the server did not utilize proper Content-Type parsing to validate character set encodings before passing them to the body parsing logic, allowing malicious encodings to trigger computationally expensive operations.

Attack Vector

The attack can be executed remotely over the network without any authentication or user interaction. An attacker sends HTTP POST requests to the GraphQL endpoint with specially crafted Content-Type headers containing exotic character set encodings. These malformed encodings exploit inefficient regex processing in the request parsing pipeline, causing the server to consume excessive CPU cycles while attempting to decode the request body.

// Security patch adding Content-Type parsing validation
// Source: https://github.com/apollographql/apollo-server/commit/d25a5bdc377826ad424fcf7f8d1d062055911643

 import type { WithRequired } from '@apollo/utils.withrequired';
 import cors from 'cors';
 import bodyParser from 'body-parser';
+import { parse as parseContentType } from 'content-type';
 import http, { type IncomingMessage, type ServerResponse } from 'http';
 import type { ListenOptions } from 'net';
 import { parse as urlParse } from 'url';

The fix introduces proper Content-Type header parsing using the content-type package, which validates and sanitizes character set parameters before they reach the body parsing middleware.

Detection Methods for CVE-2026-23897

Indicators of Compromise

• Unusual spikes in CPU utilization on servers running Apollo Server standalone instances
• High volume of HTTP POST requests to GraphQL endpoints with non-standard or exotic Content-Type charset values
• Server response time degradation or timeout errors for GraphQL queries
• Multiple requests originating from single IP addresses with varying charset encoding patterns

Detection Strategies

• Monitor HTTP request logs for Content-Type headers containing unusual or uncommon character set encodings
• Implement rate limiting on GraphQL endpoints to detect and block high-frequency request patterns
• Deploy web application firewall (WAF) rules to inspect and filter requests with malformed Content-Type headers
• Configure application performance monitoring (APM) to alert on abnormal CPU consumption patterns

Monitoring Recommendations

• Enable detailed access logging for all GraphQL endpoint traffic with full header capture
• Set up automated alerting for CPU utilization exceeding baseline thresholds on Apollo Server instances
• Implement network traffic analysis to identify potential DoS attack patterns targeting GraphQL services
• Review server logs regularly for patterns indicating attempted exploitation of character encoding vulnerabilities

How to Mitigate CVE-2026-23897

Immediate Actions Required

• Upgrade Apollo Server to patched versions: 4.13.0 or later for version 4.x, 5.4.0 or later for version 5.x
• If using versions 2.0.0 to 3.13.0, migrate to a supported version with the security fix
• Consider migrating from startStandaloneServer to integration packages like @as-integrations/express5 which are not affected
• Implement rate limiting at the network or application level as an interim protective measure

Patch Information

Security patches have been released by the Apollo GraphQL team. The fixes introduce proper Content-Type header parsing using the content-type package to validate character set encodings before processing request bodies.

Patch commits:

• GitHub Commit d25a5bd
• GitHub Commit e9d49d1

For complete details, refer to the GitHub Security Advisory GHSA-mp6q-xf9x-fwf7.

Workarounds

• Deploy a reverse proxy or WAF in front of Apollo Server to filter and validate Content-Type headers before they reach the application
• Migrate to integration packages such as @as-integrations/express5 or @as-integrations/next which handle request parsing differently and are not vulnerable
• Implement request body size limits and timeout configurations to minimize the impact of potential DoS attempts
• Use network-level rate limiting to restrict the number of requests from individual IP addresses

# Example: Update Apollo Server to patched version
npm update @apollo/server@^4.13.0
# or for version 5.x
npm update @apollo/server@^5.4.0

# Verify installed version
npm list @apollo/server