Ardatan CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review Ardatan CVE published 2026-10-22

CVE-2026-114604

CVE-2026-114604 is a prototype pollution vulnerability in the `@graphql-tools/utils` package, specifically in the `mergeIncrementalResult` function. This function is used to merge incremental GraphQL response parts into an accumulated execution result. The vulnerability is caused by the function's ability to walk through non-primitive path segments, allowing an attacker to pollute the prototype of an object.