#8191 ada1200 - ⚠️ SECURITY @apollo/server/standalone:
Apollo Server now rejects GraphQL GET requests which contain a Content-Type header other than application/json (with optional parameters such as ; charset=utf-8). Any other value is now rejected with a 415 status code.
(GraphQL GET requests without a Content-Type header are still allowed, though they do still need to contain a non-empty X-Apollo-Operation-Name or Apollo-Require-Preflight header to be processed if the default CSRF prevention feature is enabled.)
This improvement makes Apollo Server's CSRF more resistant to browsers which implement CORS in non-spec-compliant ways. Apollo is aware of one browser which as of March 2026 has a bug which allows an attacker to circumvent Apollo Server's CSRF prevention feature to carry out read-only XS-Search-style CSRF attacks. The browser vendor is in the process of patching this vulnerability; upgrading Apollo Server to v5.5.0 mitigates this vulnerability.
If your server uses cookies (or HTTP Basic Auth) for authentication, Apollo encourages you to upgrade to v5.5.0.
This is technically a backwards-incompatible change. Apollo is not aware of any GraphQL clients which provide non-empty Content-Type headers with GET requests with types other than application/json. If your use case requires such requests, please file an issue and we may add more configurability in a follow-up release.
See advisory GHSA-9q82-xgwf-vj6h for more details.
ada1200]:
#8191 ada1200 Thanks @glasser! - ⚠️ SECURITY @apollo/server/standalone:
Apollo Server now rejects GraphQL GET requests which contain a Content-Type header other than application/json (with optional parameters such as ; charset=utf-8). Any other value is now rejected with a 415 status code.
(GraphQL GET requests without a Content-Type header are still allowed, though they do still need to contain a non-empty X-Apollo-Operation-Name or Apollo-Require-Preflight header to be processed if the default CSRF prevention feature is enabled.)
This improvement makes Apollo Server's CSRF more resistant to browsers which implement CORS in non-spec-compliant ways. Apollo is aware of one browser which as of March 2026 has a bug which allows an attacker to circumvent Apollo Server's CSRF prevention feature to carry out read-only XS-Search-style CSRF attacks. The browser vendor is in the process of patching this vulnerability; upgrading Apollo Server to v5.5.0 mitigates this vulnerability.
If your server uses cookies (or HTTP Basic Auth) for authentication, Apollo encourages you to upgrade to v5.5.0.
This is technically a backwards-incompatible change. Apollo is not aware of any GraphQL clients which provide non-empty Content-Type headers with GET requests with types other than application/json. If your use case requires such requests, please file an issue and we may add more configurability in a follow-up release.
See advisory GHSA-9q82-xgwf-vj6h for more details.
d25a5bd Thanks @phryneas! - ⚠️ SECURITY @apollo/server/standalone:
The default configuration of startStandaloneServer was vulnerable to denial of service (DoS) attacks through specially crafted request bodies with exotic character set encodings.
In accordance with RFC 7159, we now only accept request bodies encoded in UTF-8, UTF-16 (LE or BE), or UTF-32 (LE or BE).
Any other character set will be rejected with a 415 Unsupported Media Type error.
Note that the more recent JSON RFC, RFC 8259, is more strict and will only allow UTF-8.
Since this is a minor release, we have chosen to remain compatible with the more permissive RFC 7159 for now.
In a future major release, we may tighten this restriction further to only allow UTF-8.
If you were not using startStandaloneServer, you were not affected by this vulnerability.
Generally, please note that we provide startStandaloneServer as a convenience tool for quickly getting started with Apollo Server.
For production deployments, we recommend using Apollo Server with a more fully-featured web server framework such as Express, Koa, or Fastify, where you have more control over security-related configuration options.
d25a5bd]:
#8180 e9d49d1 Thanks @github-actions! - ⚠️ SECURITY @apollo/server/standalone:
The default configuration of startStandaloneServer was vulnerable to denial of service (DoS) attacks through specially crafted request bodies with exotic character set encodings.
In accordance with RFC 7159, we now only accept request bodies encoded in UTF-8, UTF-16 (LE or BE), or UTF-32 (LE or BE).
Any other character set will be rejected with a 415 Unsupported Media Type error.
Additionally, upstream libraries used by this version of Apollo Server may not support all of these encodings, so some requests may still fail even if they pass this check.
If you were not using startStandaloneServer, you were not affected by this vulnerability.
Generally, please note that we provide startStandaloneServer as a convenience tool for quickly getting started with Apollo Server.
For production deployments, we recommend using Apollo Server with a more fully-featured web server framework such as Express, Koa, or Fastify, where you have more control over security-related configuration options.
Also please note that Apollo Server 4.x is considered EOL as of January 26, 2026, and Apollo no longer commits to providing support or updates for it. Please prioritize migrating to Apollo Server 5.x for continued support and updates.
e9d49d1]:
#8062 8e54e58 Thanks @cristunaranjo! - Allow configuration of graphql execution options (maxCoercionErrors)
const server = new ApolloServer({
typeDefs,
resolvers,
executionOptions: {
maxCoercionErrors: 50,
},
});#8014 26320bc Thanks @mo4islona! - Expose graphql validation options.
const server = new ApolloServer({
typeDefs,
resolvers,
validationOptions: {
maxErrors: 10,
},
});#8161 51acbeb Thanks @jerelmiller! - Fix an issue where some bundlers would fail to build because of the dynamic import for the optional peer dependency on @yaacovcr/transform introduced in @apollo/server 5.1.0. To provide support for the legacy incremental format, you must now provide the legacyExperimentalExecuteIncrementally option to the ApolloServer constructor.
import { legacyExecuteIncrementally } from '@yaacovcr/transform';
const server = new ApolloServer({
// ...
legacyExperimentalExecuteIncrementally: legacyExecuteIncrementally,
});If the legacyExperimentalExecuteIncrementally option is not provided and the client sends an Accept header with a value of multipart/mixed; deferSpec=20220824, an error is returned by the server.
51acbeb]:
#8148 80a1a1a Thanks @jerelmiller! - Apollo Server now supports the incremental delivery protocol (@defer and @stream) that ships with graphql@17.0.0-alpha.9. To use the current protocol, clients must send the Accept header with a value of multipart/mixed; incrementalSpec=v0.2.
Upgrading to 5.1 will depend on what version of graphql you have installed and whether you already support the incremental delivery protocol.
graphql@16 without incremental deliveryContinue using graphql v16 with no additional changes. Incremental delivery won't be available.
graphql@16 but would like to add support for incremental deliveryInstall graphql@17.0.0-alpha.9 and follow the "Incremental delivery" guide to add the @defer and @stream directives to your schema. Clients should send the Accept header with a value of multipart/mixed; incrementalSpec=v0.2 to get multipart responses.
graphql@17.0.0-alpha.2 and use incremental deliveryYou must upgrade to graphql@17.0.0-alpha.9 to continue using incremental delivery. If you'd like to continue providing support for the legacy incremental protocol, install the @yaacovcr/transform package. Apollo Server will attempt to load this module when the client specifies an Accept header with a value of multipart/mixed; deferSpec=20220824. If this package is not installed, an error is returned by the server.
Because Apollo Server now supports multiple versions of the incremental delivery types, the existing incremental delivery types have been renamed with an Alpha2 suffix. If you import these types in your code, you will need to add the Alpha2 suffix.
import type {
- GraphQLExperimentalFormattedInitialIncrementalExecutionResult,
+ GraphQLExperimentalFormattedInitialIncrementalExecutionResultAlpha2,
- GraphQLExperimentalFormattedSubsequentIncrementalExecutionResult,
+ GraphQLExperimentalFormattedSubsequentIncrementalExecutionResultAlpha2,
- GraphQLExperimentalFormattedIncrementalResult,
+ GraphQLExperimentalFormattedIncrementalResultAlpha2,
- GraphQLExperimentalFormattedIncrementalDeferResult,
+ GraphQLExperimentalFormattedIncrementalDeferResultAlpha2,
- GraphQLExperimentalFormattedIncrementalStreamResult,
+ GraphQLExperimentalFormattedIncrementalStreamResultAlpha2,
} from '@apollo/server';
Incremental delivery types for the graphql@17.0.0-alpha.9 version are now available using the Alpha9 suffix:
import type {
GraphQLExperimentalFormattedInitialIncrementalExecutionResultAlpha9,
GraphQLExperimentalFormattedSubsequentIncrementalExecutionResultAlpha9,
GraphQLExperimentalFormattedIncrementalResultAlpha9,
GraphQLExperimentalFormattedIncrementalDeferResultAlpha9,
GraphQLExperimentalFormattedIncrementalStreamResultAlpha9,
GraphQLExperimentalFormattedCompletedResultAlpha9,
GraphQLExperimentalPendingResultAlpha9,
} from '@apollo/server';80a1a1a]:
#8148 80a1a1a Thanks @jerelmiller! - Apollo Server now supports the incremental delivery protocol (@defer and @stream) that ships with graphql@17.0.0-alpha.9. To use the current protocol, clients must send the Accept header with a value of multipart/mixed; incrementalSpec=v0.2.
Upgrading to 5.1 will depend on what version of graphql you have installed and whether you already support the incremental delivery protocol.
graphql@16 without incremental deliveryContinue using graphql v16 with no additional changes. Incremental delivery won't be available.
graphql@16 but would like to add support for incremental deliveryInstall graphql@17.0.0-alpha.9 and follow the "Incremental delivery" guide to add the @defer and @stream directives to your schema. Clients should send the Accept header with a value of multipart/mixed; incrementalSpec=v0.2 to get multipart responses.
graphql@17.0.0-alpha.2 and use incremental deliveryYou must upgrade to graphql@17.0.0-alpha.9 to continue using incremental delivery. If you'd like to continue providing support for the legacy incremental protocol, install the @yaacovcr/transform package. Apollo Server will attempt to load this module when the client specifies an Accept header with a value of multipart/mixed; deferSpec=20220824. If this package is not installed, an error is returned by the server.
Because Apollo Server now supports multiple versions of the incremental delivery types, the existing incremental delivery types have been renamed with an Alpha2 suffix. If you import these types in your code, you will need to add the Alpha2 suffix.
import type {
- GraphQLExperimentalFormattedInitialIncrementalExecutionResult,
+ GraphQLExperimentalFormattedInitialIncrementalExecutionResultAlpha2,
- GraphQLExperimentalFormattedSubsequentIncrementalExecutionResult,
+ GraphQLExperimentalFormattedSubsequentIncrementalExecutionResultAlpha2,
- GraphQLExperimentalFormattedIncrementalResult,
+ GraphQLExperimentalFormattedIncrementalResultAlpha2,
- GraphQLExperimentalFormattedIncrementalDeferResult,
+ GraphQLExperimentalFormattedIncrementalDeferResultAlpha2,
- GraphQLExperimentalFormattedIncrementalStreamResult,
+ GraphQLExperimentalFormattedIncrementalStreamResultAlpha2,
} from '@apollo/server';
Incremental delivery types for the graphql@17.0.0-alpha.9 version are now available using the Alpha9 suffix:
import type {
GraphQLExperimentalFormattedInitialIncrementalExecutionResultAlpha9,
GraphQLExperimentalFormattedSubsequentIncrementalExecutionResultAlpha9,
GraphQLExperimentalFormattedIncrementalResultAlpha9,
GraphQLExperimentalFormattedIncrementalDeferResultAlpha9,
GraphQLExperimentalFormattedIncrementalStreamResultAlpha9,
GraphQLExperimentalFormattedCompletedResultAlpha9,
GraphQLExperimentalPendingResultAlpha9,
} from '@apollo/server';80a1a1a]:
80a1a1a]:
Apollo Server v5 has very few breaking API changes. It is a small upgrade focused largely on adjusting which versions of Node.js and Express are supported.
Read our migration guide for more details on how to update your app.
graphql library older than v16.11.0. (Apollo Server 4 supports graphql v16.6.0 or later.) Upgrade graphql before upgrading Apollo Server.@apollo/server/express4, or you could import it from the separate package @as-integrations/express4. In Apollo Server 5, you must import it from the separate package. You can migrate your server to the new package before upgrading to Apollo Server 5. (You can also use @as-integrations/express5 for a middleware that works with Express 5.)fetch implementation for HTTP requests by default, instead of the node-fetch npm package. If your server uses an HTTP proxy to make HTTP requests, you need to configure it in a slightly different way. See the migration guide for details.startStandaloneServer no longer uses Express. This is mostly invisible, but it does set slightly fewer headers. If you rely on the fact that this server is based on Express, you should explicitly use the Express middleware.@defer and @stream (which requires using a pre-release version of graphql v17) now explicitly only works with version 17.0.0-alpha.2 of graphql. Note that this supports the same incremental delivery protocol implemented by Apollo Server 4, which is not the same protocol in the latest alpha version of graphql. As this support is experimental, we may switch over from "only alpha.2 is supported" to "only a newer alpha or final release is supported, with a different protocol" during the lifetime of Apollo Server 5.variables map for a variable declared in the operation as a String) with a 400 status code, indicating a client error. This is also the behavior of Apollo Server 3. Apollo Server 4 mistakenly responds to these requests with a 200 status code by default; we recommended the use of the status400ForVariableCoercionErrors: true option to restore the intended behavior. That option now defaults to true.precomputedNonce option to landing page plugins (which was only non-deprecated for 8 days) has been removed.There are a few other small changes in v5:
#8076 5b26558 Thanks @valters! - Fix some error logs to properly call logger.error or logger.warn with this set. This fixes errors or crashes from logger implementations that expect this to be set properly in their methods.
#7515 100233a Thanks @trevor-scheer! - ApolloServerPluginSubscriptionCallback now takes a fetcher argument, like the usage and schema reporting plugins. The default value is Node's built-in fetch.
Updated dependencies [100233a]:
#8076 5b26558 Thanks @valters! - Fix some error logs to properly call logger.error or logger.warn with this set. This fixes errors or crashes from logger implementations that expect this to be set properly in their methods.
Updated dependencies [5b26558, 100233a, 100233a, 100233a, 100233a]:
Drop support for Node.JS v14, v16, and v20.
The integration test suite no longer uses lib: ["dom"] to tell TypeScript to assume DOM-related symbols are in the global namespace. If your integration library's test suite relied on this behavior, you may need to add lib: ["dom"] to the compilerOptions section of your test suite's tsconfig.json.
#8076 5b26558 Thanks @valters! - Fix some error logs to properly call logger.error or logger.warn with this set. This fixes errors or crashes from logger implementations that expect this to be set properly in their methods.
Updated dependencies [5b26558, 100233a, 100233a, 100233a, 100233a]: