Skip to main content

CISA alerts on graphql-upload-minimal prototype pollution

Source Decision Insights Threat Desk Published March 12, 2026 Companies 3
Human View Machine View

3 companies named across 3 categories, the first article referencing GraphQL.

Companies mentioned

Best suited for

Seniority
Staff
Job function
Cybersecurity / Information Security
Persona
Security Architect
Buyer role
Technical Implementer / Administrator
Decision stage
Post Buy
Adoption curve
Early Majority
Technology maturity
Established Technology
Industry
Information Technology / Software & Services / IT Services / Internet Services & Infrastructure

Our classification, not the publisher's statement. Best suited for, not only for.

Version 1.6.1 of the Flash Payments package graphql-upload-minimal contains a prototype pollution vulnerability that can alter global JavaScript prototypes and affect the entire Node.js process.

CVE-2025-65587 identifies the issue in graphql-upload-minimal version 1.6.1; the vulnerability is located in the processRequest() function, which parses multipart/form-data and maps uploaded files into the GraphQL operations object. That function processes a user-supplied map parameter that determines where uploaded files are placed in the operations.variables object, and user-supplied property paths are not validated before being resolved and written into the target object, permitting special JavaScript property names such as __proto__, __constructor__, and prototype to traverse the prototype chain and modify Object.prototype.

Because Object.prototype is the foundational prototype for most JavaScript objects, modifying it can affect the behavior of all Node.js processes. The impact extends across the entire Node.js process and persists until the service is restarted, and it can potentially result in logic corruption, Denial of Service (DoS), or unintended privilege escalation.

Users should upgrade to graphql-upload-minimal version 1.6.3 or later, available at https://github.com/flash-oss/graphql-upload-minimal/tree/master. The patched release introduces safeguards to prevent unsafe prototype-chain property assignments during multipart file upload processing.

One or more vendors are listed for this advisory; consult the full report for additional vendor details. The advisory credits Maor Caplan of Alma Security for reporting the vulnerability and notes the document was written by Michael Bragg; further information and the patch comparison are available at https://github.com/flash-oss/graphql-upload-minimal/compare/v1.6.1...flash-oss:graphql-upload-minimal:v1.6.3.

Blog post, originally published by Michael Bragg at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-alerts-on-graphql-upload-minimal-prototype-pollution/",
        "name": "CISA alerts on graphql-upload-minimal prototype pollution",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-alerts-on-graphql-upload-minimal-prototype-pollution/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/graphql/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/graphql/",
      "name": "GraphQL"
    },
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "Staff"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Cybersecurity / Information Security"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Architect"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Technical Implementer / Administrator"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Technology maturity",
        "audienceType": "Established Technology"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Internet Services & Infrastructure"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T14:05:12-06:00",
    "datePublished": "2026-03-12T12:58:44-06:00",
    "description": "graphql-upload-minimal prototype pollution in v1.6.1 can modify Object.prototype in Node.js; upgrade to version 1.6.3 or later.",
    "headline": "CISA alerts on graphql-upload-minimal prototype pollution",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Michael Bragg"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/907705"
    },
    "keywords": [
      "Denial of Service",
      "Node",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-alerts-on-graphql-upload-minimal-prototype-pollution/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/graphql/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/graphql/",
        "name": "GraphQL"
      },
      {
        "@id": "https://decisioninsights.ai/registry/the-node-foundation/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/the-node-foundation/",
        "name": "Node.js"
      },
      {
        "@id": "https://decisioninsights.ai/projects/graphql/#project",
        "@type": "SoftwareSourceCode",
        "mainEntityOfPage": "https://decisioninsights.ai/projects/graphql/",
        "name": "GraphQL"
      },
      {
        "@type": "SoftwareSourceCode",
        "name": "Node.js"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages