Search: CVE-2026-114604

A prototype pollution vulnerability exists in the graphql-tools package from versions 10.10.1 up to but not including 12.0.2. The mergeIncrementalResult helper improperly handles path segments without validating their primitive types, allowing malicious input to write attacker-controlled properties to Object.prototype. This flaw is fixed in version 12.0.2.