{"id":"CVE-2025-27097","summary":"Cache variables with the operations when transforms exist on the root level even if variables change in the further requests with the same operation","details":"GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. When a user transforms on the root level or single source with transforms, and the client sends the same query with different variables, the initial variables are used in all following requests until the cache evicts DocumentNode. If a token is sent via variables, the following requests will act like the same token is sent even if the following requests have different tokens. This can cause a short memory leak but it won't grow per each request but per different operation until the cache evicts DocumentNode by LRU mechanism.","aliases":["GHSA-rr4x-crhf-8886"],"modified":"2026-07-08T07:34:15.623352685Z","published":"2025-02-20T20:15:53.648Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27097.json","unresolved_ranges":[{"extracted_events":[{"introduced":"@graphql-mesh/runtime: \u003e= 0.96.9, \u003c 0.96.9"},{"last_affected":"@graphql-mesh/runtime: \u003e= 0.96.9, \u003c 0.96.9"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"GitHub_M","cwe_ids":["CWE-400"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27097.json"},{"type":"ADVISORY","url":"https://github.com/ardatan/graphql-mesh/security/advisories/GHSA-rr4x-crhf-8886"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27097"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ardatan/graphql-mesh","events":[{"introduced":"9ae0539d8a50aaf91afe3f1de9577926b6a08f6c"},{"last_affected":"04e0e74b53cb2790027b2d0cb1d59cab96c2cd4d"}],"database_specific":{"extracted_events":[{"introduced":"0.96.5"},{"last_affected":"0.96.5"},{"introduced":"0.96.6"},{"last_affected":"0.96.6"},{"introduced":"0.96.7"},{"last_affected":"0.96.7"},{"introduced":"0.96.8"},{"last_affected":"0.96.8"}],"cpe":["cpe:2.3:a:the-guild:graphql_mesh:0.96.5:*:*:*:*:node.js:*:*","cpe:2.3:a:the-guild:graphql_mesh:0.96.6:*:*:*:*:node.js:*:*","cpe:2.3:a:the-guild:graphql_mesh:0.96.7:*:*:*:*:node.js:*:*","cpe:2.3:a:the-guild:graphql_mesh:0.96.8:*:*:*:*:node.js:*:*"],"source":"CPE_STRING"}}],"versions":["0.96.5","0.96.7","release-1708699202312","@omnigraph/thrift@0.0.5","@omnigraph/sqlite@0.0.6","@omnigraph/soap@0.96.7","@omnigraph/raml@0.98.2","@omnigraph/openapi@0.98.2","@omnigraph/neo4j@0.0.5","@omnigraph/mysql@0.0.5","@omnigraph/json-schema@0.98.2","@graphql-mesh/utils@0.96.6","@graphql-mesh/urql-exchange@0.97.7","@graphql-mesh/types@0.96.6","@graphql-mesh/tuql@0.97.5","@graphql-mesh/transport-thrift@0.0.2","@graphql-mesh/transport-sqlite@0.0.2","@graphql-mesh/transport-soap@0.0.3","@graphql-mesh/transport-rest@0.0.3","@graphql-mesh/transport-neo4j@0.0.2","@graphql-mesh/transport-mysql@0.0.2","@graphql-mesh/transport-http@0.0.3","@graphql-mesh/transport-common@0.0.3","@graphql-mesh/transform-type-merging@0.96.6","@graphql-mesh/transform-transfer-schema@0.96.6","@graphql-mesh/transform-resolvers-composition@0.96.6","@graphql-mesh/transform-replace-field@0.96.6","@graphql-mesh/transform-rename@0.96.7","@graphql-mesh/transform-rate-limit@0.96.6","@graphql-mesh/transform-prune@0.96.6","@graphql-mesh/transform-prefix@0.96.6","@graphql-mesh/transform-naming-convention@0.96.6","@graphql-mesh/transform-hoist-field@0.96.6","@graphql-mesh/transform-hive@0.96.8","@graphql-mesh/transform-filter-schema@0.96.6","@graphql-mesh/transform-federation@0.96.6","@graphql-mesh/transform-extend@0.96.6","@graphql-mesh/transform-encapsulate@0.96.6","@graphql-mesh/transform-cache@0.96.6","@graphql-mesh/thrift@0.97.4","@graphql-mesh/supergraph@0.1.6","@graphql-mesh/store@0.96.6","@graphql-mesh/soap@0.96.7","@graphql-mesh/serve-runtime@0.1.1","@graphql-mesh/serve-cli@0.2.1","@graphql-mesh/runtime@0.97.7","@graphql-mesh/raml@0.98.2","@graphql-mesh/postgraphile@0.96.6","@graphql-mesh/plugin-statsd@0.96.6","@graphql-mesh/plugin-snapshot@0.96.6","@graphql-mesh/plugin-response-cache@0.96.8","@graphql-mesh/plugin-rate-limit@0.96.7","@graphql-mesh/plugin-prometheus@0.96.7","@graphql-mesh/plugin-operation-field-permissions@0.96.6","@graphql-mesh/plugin-newrelic@0.96.6","@graphql-mesh/plugin-mock@0.96.6","@graphql-mesh/plugin-live-query@0.96.6","@graphql-mesh/plugin-http-details-extensions@0.96.6","@graphql-mesh/plugin-http-cache@0.96.6","@graphql-mesh/plugin-hive@0.96.8","@graphql-mesh/plugin-deduplicate-request@0.96.6","@graphql-mesh/openapi@0.98.2","@graphql-mesh/odata@0.96.6","@graphql-mesh/neo4j@0.96.7","@graphql-mesh/mysql@0.96.7","@graphql-mesh/mongoose@0.96.7","@graphql-mesh/merger-stitching@0.96.6","@graphql-mesh/merger-federation@0.96.6","@graphql-mesh/merger-bare@0.96.6","@graphql-mesh/json-schema@0.98.2","@graphql-mesh/http@0.97.7","@graphql-mesh/grpc@0.97.6","@graphql-mesh/graphql@0.96.6","@graphql-mesh/fusion-runtime@0.1.1","@graphql-mesh/config@0.98.7","@graphql-mesh/compose-cli@0.1.1","@graphql-mesh/cli@0.88.9","@graphql-mesh/cache-redis@0.96.6","@graphql-mesh/cache-localforage@0.96.6","@graphql-mesh/cache-file@0.96.6","@graphql-mesh/cache-cfw-kv@0.96.6","@graphql-mesh/apollo-link@0.97.7","release-1708537627461","@graphql-mesh/serve-runtime@0.1.0","@graphql-mesh/serve-cli@0.2.0","@graphql-mesh/fusion-runtime@0.1.0","@graphql-mesh/compose-cli@0.1.0","@graphql-mesh/cli@0.88.8","release-1707815188135","@omnigraph/thrift@0.0.4","@omnigraph/sqlite@0.0.5","@omnigraph/soap@0.96.6","@omnigraph/raml@0.98.1","@omnigraph/openapi@0.98.1","@omnigraph/neo4j@0.0.4","@omnigraph/mysql@0.0.4","@omnigraph/json-schema@0.98.1","@graphql-mesh/utils@0.96.5","@graphql-mesh/urql-exchange@0.97.6","@graphql-mesh/types@0.96.5","@graphql-mesh/tuql@0.97.4","@graphql-mesh/transport-thrift@0.0.1","@graphql-mesh/transport-sqlite@0.0.1","@graphql-mesh/transport-soap@0.0.2","@graphql-mesh/transport-rest@0.0.2","@graphql-mesh/transport-neo4j@0.0.1","@graphql-mesh/transport-mysql@0.0.1","@graphql-mesh/transport-http@0.0.2","@graphql-mesh/transport-common@0.0.2","@graphql-mesh/transform-type-merging@0.96.5","@graphql-mesh/transform-transfer-schema@0.96.5","@graphql-mesh/transform-resolvers-composition@0.96.5","@graphql-mesh/transform-replace-field@0.96.5","@graphql-mesh/transform-rename@0.96.6","@graphql-mesh/transform-rate-limit@0.96.5","@graphql-mesh/transform-prune@0.96.5","@graphql-mesh/transform-prefix@0.96.5","@graphql-mesh/transform-naming-convention@0.96.5","@graphql-mesh/transform-hoist-field@0.96.5","@graphql-mesh/transform-hive@0.96.7","@graphql-mesh/transform-filter-schema@0.96.5","@graphql-mesh/transform-federation@0.96.5","@graphql-mesh/transform-extend@0.96.5","@graphql-mesh/transform-encapsulate@0.96.5","@graphql-mesh/transform-cache@0.96.5","@graphql-mesh/thrift@0.97.3","@graphql-mesh/supergraph@0.1.5","@graphql-mesh/store@0.96.5","@graphql-mesh/soap@0.96.6","@graphql-mesh/serve-runtime@0.0.2","@graphql-mesh/serve-cli@0.1.0","@graphql-mesh/runtime@0.97.6","@graphql-mesh/raml@0.98.1","@graphql-mesh/postgraphile@0.96.5","@graphql-mesh/plugin-statsd@0.96.5","@graphql-mesh/plugin-snapshot@0.96.5","@graphql-mesh/plugin-response-cache@0.96.7","@graphql-mesh/plugin-rate-limit@0.96.6","@graphql-mesh/plugin-prometheus@0.96.6","@graphql-mesh/plugin-operation-field-permissions@0.96.5","@graphql-mesh/plugin-newrelic@0.96.5","@graphql-mesh/plugin-mock@0.96.5","@graphql-mesh/plugin-live-query@0.96.5","@graphql-mesh/plugin-http-details-extensions@0.96.5","@graphql-mesh/plugin-http-cache@0.96.5","@graphql-mesh/plugin-hive@0.96.7","@graphql-mesh/plugin-deduplicate-request@0.96.5","@graphql-mesh/openapi@0.98.1","@graphql-mesh/odata@0.96.5","@graphql-mesh/neo4j@0.96.6","@graphql-mesh/mysql@0.96.6","@graphql-mesh/mongoose@0.96.6","@graphql-mesh/merger-stitching@0.96.5","@graphql-mesh/merger-federation@0.96.5","@graphql-mesh/merger-bare@0.96.5","@graphql-mesh/json-schema@0.98.1","@graphql-mesh/http@0.97.6","@graphql-mesh/grpc@0.97.5","@graphql-mesh/graphql@0.96.5","@graphql-mesh/fusion-runtime@0.0.2","@graphql-mesh/config@0.98.6","@graphql-mesh/compose-cli@0.0.2","@graphql-mesh/cli@0.88.7","@graphql-mesh/cache-redis@0.96.5","@graphql-mesh/cache-localforage@0.96.5","@graphql-mesh/cache-file@0.96.5","@graphql-mesh/cache-cfw-kv@0.96.5","@graphql-mesh/apollo-link@0.97.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27097.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"}]}