Critical · published May 2, 2024
🚨 A bug in Apollo Router could cause queries and mutations to run unexpectedly — think of it as a server waiter mixing up orders that lead to disastrous results! 🔥 Picture a restaurant where the waiter has a memory issue, resulting in incorrect dishes being delivered to the wrong tables. Instead of getting the delicious steak you ordered, you might be served a plate of fish that some other patron requested weeks ago! This vulnerability could lead to absolutely devastating consequences: you might end up deleting the wrong user, or worse, fetching data you never asked for. Imagine the confusion in your application when it pulls up `fetchUsers(type: TRIAL)` instead of `fetchUsers(type: ENTERPRISE)`! Your data integrity is at risk, and that’s a serious problem.
Picture a restaurant where the waiter has a memory issue, resulting in incorrect dishes being delivered to the wrong tables. Instead of getting the delicious steak you ordered, you might be served a plate of fish that some other patron requested weeks ago! This critical vulnerability in Apollo Router arises from a flaw in its cache retrieval logic, specifically affecting Router instances using distributed query plan caching. It may inadvertently execute modified queries stored in the cache, leading to unintended operations or errors.
This vulnerability could lead to absolutely devastating consequences: you might end up deleting the wrong user, or worse, fetching data you never asked for. Imagine the confusion in your application when it pulls up `fetchUsers(type: TRIAL)` instead of `fetchUsers(type: ENTERPRISE)`! Your data integrity is at risk, and that’s a serious problem. To stay safe, users should upgrade to Apollo Router version 1.45.1 or above, or downgrade to 1.43.2, as versions 1.44.0 and 1.45.0 are not recommended. If upgrades are not possible, disable distributed query plan caching to mitigate the issue immediately! You've got this! Follow these steps to safeguard your application and keep your data secure! 🛡️