CVE-2025-27097

Summary

CVE-2025-27097 is a vulnerability affecting GraphQL Mesh, a GraphQL Federation framework and gateway. When a user transforms queries on the root level or single source, and the client sends the same query with different variables, the initial variables are utilized in subsequent requests until the cache evicts DocumentNode. This can lead to a short-term memory leak, where a token sent via variables is inadvertently used in subsequent requests, even if they bear different tokens. The issue does not escalate with each request but only with different operations until the cache evicts DocumentNode based on the Least Recently Used (LRU) mechanism.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.