The vulnerability exists in the mergeDeep function of the GraphQL Tools utilities package. This function recursively merges source objects and does not filter out keys that target Object and Function prototypes, such as __proto__, constructor, or prototype. An attacker can alias GraphQL fields to these names in a query, causing mergeDeep during normal schema stitching or supergraph result merging to overwrite Function.prototype.call. The result is that the GraphQL server becomes unable to process subsequent requests until it is restarted, leading to a service disruption. The attack does not grant arbitrary code execution under the stated conditions; it primarily causes denial of service by corrupting the prototype chain.

Affected systems are deployments that employ the ardatan GraphQL Tools utilities package @graphql-tools/utils prior to version 12.0.1. Any GraphQL server or gateway that incorporates this utilities library for schema stitching, stitching, or result merging is vulnerable.

The CVSS score of 8.2 indicates a high severity for service disruption. The exploit is unauthenticated and can be triggered from any GraphQL client that can send a query containing field aliases such as __proto__. The EPSS score of <1% signals a very low probability of exploitation in the wild, but the lack of an authentication requirement means attackers could still target the server repeatedly. The vulnerability is not listed in CISA KEV, yet its high impact warrants immediate attention. Attackers could continuously target the server with maliciously crafted queries to induce repeated downtime, although no direct remote code execution is reported.