CVE-2026-104852: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in ardatan graphql-tools

The vulnerability exists in the mergeDeep function of the GraphQL Tools utils package before version 12.0.1. This function recursively merges source objects but does not exclude prototype-related keys such as __proto__, constructor, or prototype. An unauthenticated attacker can craft GraphQL queries that alias fields to these keys, causing the mergeDeep function to traverse and modify Object and Function prototypes. Specifically, Function.prototype.call can be overwritten with attacker-controlled data, breaking the execution of subsequent requests in the same process. This flaw is addressed by patching the package in version 12.0.1.

An unauthenticated attacker can exploit this vulnerability to perform prototype pollution, leading to the overwriting of critical JavaScript prototype functions like Function.prototype.call. This results in denial of service by breaking subsequent GraphQL requests in the affected process until it is restarted. There is no indication of remote code execution or data exfiltration from the provided data.

Upgrade the graphql-tools package to version 12.0.1 or later, where this prototype pollution vulnerability is fixed. No other mitigations are indicated or required according to the available information.