CVE-2024-23841

CVEs › CVE-2024-23841

Description

apollo-client-nextjs is the Apollo Client support for the Next.js App Router. The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this vulnerability, an attacker would need to either inject malicious input (e.g. by redirecting a user to a specifically-crafted link) or arrange to have malicious input be returned by a GraphQL server (e.g. by persisting it in a database). To fix this issue, please update to version 0.7.0 or later.

Overview

State: PUBLISHED
Assigner (CNA): GitHub_M
CVSS severity: HIGH
CVSS score: 8.2 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Effective score: 8.2 / 10 HIGH source: CNA overview
CWE(s): CWE-80
Reserved: 2024-01-22
Published: 2024-01-30 18:14 UTC
Last updated: 2025-06-17 23:29 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/23xxx/CVE-2024-23841.json
Linked Threat: CVE-2024-23841 — XSS in @apollo/experimental-nextjs-app-support

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2024-01-30 18:15:48 UTC
NVD last modified: 2026-06-17 07:13:43 UTC
NVD CVSS v3.1: 8.2 / 10 HIGH source: security-advisories@github.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Exploitability subscore: 3.9 / 10
Impact subscore: 4.2 / 10
EPSS score: 0.0039 (probability of exploitation in next 30 days)
EPSS percentile: 30.54% vs all CVEs — higher = more likely to be exploited, as of 2026-07-10

NVD / KEV / EPSS data refreshed 2026-07-11 13:12 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2024-0422
Assigner: GitHub_M
Published: Jan 30, 2024, 5:14:12 PM
Updated: Jun 17, 2025, 9:29:18 PM
EUVD base score (CVSS 3.1): 8.2 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EUVD-reported EPSS: 0.5000
Vendors: apollographql
Products: apollo-client-nextjs

apollo-client-nextjs (< 0.7.0)
Aliases: GHSA-rv8p-rr2h-fgpg

ENISA description: apollo-client-nextjs is the Apollo Client support for the Next.js App Router. The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this vulnerability, an attacker would need to either inject malicious input (e.g. by redirecting a user to a specifically-crafted link) or arrange to have malicious input be returned by a GraphQL server (e.g. by persisting it in a database). To fix this issue, please update to version 0.7.0 or later.

EUVD references (2)

Affected products (1)

Vendor	Product	Versions	Platforms
apollographql	apollo-client-nextjs	`< 0.7.0` (affected)	—

Affected products — CPE 2.3 (1) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

cpe:2.3:a:apollographql:apollo_client:*:*:*:*:*:node.js:*:*

Vendor references (2)

References embedded in the original CVE record by the assigning CNA.

https://github.com/apollographql/apollo-client-nextjs/security/advisories/GHSA-rv8p-rr2h-fgpg x_refsource_CONFIRM
https://github.com/apollographql/apollo-client-nextjs/commit/b92bc42abd5f8e17d4db361c36bd08e4f541a46b x_refsource_MISC

MITRE references (2) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

https://github.com/apollographql/apollo-client-nextjs/commit/b92bc42abd5f8e17d4db361c36bd08e4f541a46b x_refsource_MISC
https://github.com/apollographql/apollo-client-nextjs/security/advisories/GHSA-rv8p-rr2h-fgpg x_refsource_CONFIRM

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (4)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://github.com/apollographql/apollo-client-nextjs/commit/b92bc42abd5f8e17d4db361c36bd08e4f541a46b security-advisories@github.com Patch
https://github.com/apollographql/apollo-client-nextjs/commit/b92bc42abd5f8e17d4db361c36bd08e4f541a46b af854a3a-2127-422b-91ae-364da2661108 Patch
https://github.com/apollographql/apollo-client-nextjs/security/advisories/GHSA-rv8p-rr2h-fgpg security-advisories@github.com Vendor Advisory
https://github.com/apollographql/apollo-client-nextjs/security/advisories/GHSA-rv8p-rr2h-fgpg af854a3a-2127-422b-91ae-364da2661108 Vendor Advisory

Indicators (1)

IOCs linked to the auto-promoted Threat row.

Type	Value	VirusTotal	Attached
domain	`next.js`	no local data	2026-05-18 21:20 UTC

Remediations (21)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Patch Tuesday July 2026: Security Updates & CVE Analysis

web:zecurit.com

Get the complete breakdown of Microsoft's July 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

2026-07-15 00:29 UTC
June 2026 Critical Security Patch Update Released | security

web:blogs.oracle.com

For more information about the Critical Security Patch Update program, see the security vulnerability remediation practices page located on the Oracle Trust Center.

2026-07-15 00:29 UTC
Microsoft Update Catalog

web:catalog.update.microsoft.com

Welcome to the Microsoft Update Catalog site. We want your feedback! Visit our newsgroup or send us an email to provide us with your thoughts and suggestions. To get started using the site, enter in your search terms in the Search box above or visit our FAQ for search tips. |Newsgroup|Send us your feedback

2026-07-15 00:29 UTC
Known Exploited Vulnerabilities Catalog - CISA

web:www.cisa.gov

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework. Learn more about ...

2026-07-15 00:29 UTC
Patch Smarter, Not Harder - CISA

web:www.cisa.gov

The median time for full resolution rose to 43 days. Defenders need greater clarity and speed to patch systems in today's threat landscape. We must flip the script on patching prioritization: patch smarter, not harder.

2026-07-15 00:29 UTC
Microsoft is working on a patch for 'YellowKey ... - Computerworld

web:www.computerworld.com

Microsoft says it is considering a patch for a zero-day vulnerability, dubbed YellowKey, that allows attackers with access to a Windows device to bypass Bitlocker encryption protection and read ...

2026-07-15 00:29 UTC
Oracle Critical Security Patch Update Advisory - May 2026

web:www.oracle.com

This Critical Security Patch Update contains 35 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Security Patch Update and other Oracle Software Security Assurance activities is located at May 2026 Critical Security Patch Update: Executive Summary and Analysis.

2026-07-15 00:29 UTC
Security Update Guide - Loading - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-05-22 08:56 UTC
How to Fix Windows Update Error 0x8024401c (Full Guide)

web:www.addictivetips.com

Microsoft regularly releases updates for Windows that your computer needs in order to take advantage of the latest security patches and hotfixes. On most PCs,

2026-05-22 08:56 UTC
Microsoft KB Catalog: Updates, Issues, & Feedback - NinjaOne

web:www.ninjaone.com

Catalog of Microsoft KB updates with insights on performance & user sentiment. Find out what's working, what's not, & make informed decisions.

2026-05-22 08:56 UTC
Update Software, Mitigation M1051 - Enterprise | MITRE ATT&CK®

web:attack.mitre.org

This mitigation can be implemented through the following measures: Regular Operating System Updates Implementation: Apply the latest Windows security updates monthly using WSUS (Windows Server Update Services) or a similar patch management solution. Configure systems to check for updates automatically and schedule reboots during maintenance ...

2026-05-22 08:56 UTC
February's Patch Tuesday release fixes 59 flaws ... - Computerworld

web:www.computerworld.com

Each month, the team at Readiness analyzes the latest Patch Tuesday updates from Microsoft and provides detailed, actionable testing guidance. The company's Patch Tuesday release for February ...

2026-05-22 02:44 UTC
Microsoft KB5034441 Windows 10 security patch for BitLocker bypass is ...

web:www.tomshardware.com

Microsoft released security update KB5034441 on Patch Tuesday to fix a BitLocker encryption bypass vulnerability affecting Windows 10 users. However, some users are experiencing an update failure ...

2026-05-22 02:44 UTC
CVE: Common Vulnerabilities and Exposures

web:www.cve.org

At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures

2026-05-22 02:44 UTC
Security Update Guide - Microsoft

web:msrc.microsoft.com

The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

2026-05-22 02:44 UTC
Oracle Critical Patch Update Advisory - April 2026

web:www.oracle.com

This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

2026-05-22 02:44 UTC
The August Patch Tuesday updates for Windows 11 are here, and they fix ...

web:windowsreport.com

It's that time of the month again: Microsoft has rolled out its Patch Tuesday updates for Windows 11 versions 23H2, 22H2, and 21H2. Windows 11 23H2 and 22H2 users will see their systems updated through KB5041585, while those on 21H2 will receive KB5041592. Post-update, your build versions will be 22621.4037, 22631.4037, and 22000.3147, respectively. The updates include quality improvements ...

2026-05-22 02:44 UTC
Critical n8n Flaw Expose Automation Nodes to Full RCE

web:cyberpress.org

The third vulnerability, CVE -2026-44791 (GHSA-wrwr-h859-xh2r), is particularly alarming because it represents a patch bypass. It circumvents the previously issued fix for GHSA-hqr4-h3xv-9m3r in the XML node, reintroducing prototype pollution through a different code path. When chained with additional nodes, this too can escalate to RCE on the host.

2026-05-22 02:44 UTC
Microsoft Releases Mitigation for Windows BitLocker Security Bypass 0 ...

web:cybersecuritynews.com

No patch has been released yet; Microsoft has instead issued a multi-step manual mitigation guide while a formal security update is prepared. Windows BitLocker Security Bypass The vulnerability originates in WinRE's handling of the BootExecute registry value under HKLM\ControlSet001\Control\Session Manager.

2026-05-22 02:44 UTC
Microsoft Rolls Out Mitigations for 'YellowKey' BitLocker ...

web:www.securityweek.com

Microsoft has announced mitigations for CVE -2026-45585, a BitLocker bypass triggered via FsTx in Windows Recovery.

2026-05-22 02:44 UTC
Microsoft Issues Massive Windows Patch for 160+ Bugs ... - TechRepublic

web:www.techrepublic.com

Microsoft's April 2026 Patch Tuesday fixes 165 vulnerabilities, including two zero-days, in one of the company's largest monthly security updates.

2026-05-22 02:44 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2024-23841.json.

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T23:13:08.034Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/apollographql/apollo-client-nextjs/security/advisories/GHSA-rv8p-rr2h-fgpg",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/apollographql/apollo-client-nextjs/security/advisories/GHSA-rv8p-rr2h-fgpg"
          },
          {
            "name": "https://github.com/apollographql/apollo-client-nextjs/commit/b92bc42abd5f8e17d4db361c36bd08e4f541a46b",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/apollographql/apollo-client-nextjs/commit/b92bc42abd5f8e17d4db361c36bd08e4f541a46b"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-23841",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-31T15:44:58.053963Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-17T21:29:18.891Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "apollo-client-nextjs",
          "vendor": "apollographql",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.7.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "apollo-client-nextjs is the Apollo Client support for the Next.js App Router. The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this vulnerability, an attacker would need to either inject malicious input (e.g. by redirecting a user to a specifically-crafted link) or arrange to have malicious input be returned by a GraphQL server (e.g. by persisting it in a database). To fix this issue, please update to version 0.7.0 or later."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-30T17:14:12.023Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/apollographql/apollo-client-nextjs/security/advisories/GHSA-rv8p-rr2h-fgpg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/apollographql/apollo-client-nextjs/security/advisories/GHSA-rv8p-rr2h-fgpg"
        },
        {
          "name": "https://github.com/apollographql/apollo-client-nextjs/commit/b92bc42abd5f8e17d4db361c36bd08e4f541a46b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/apollographql/apollo-client-nextjs/commit/b92bc42abd5f8e17d4db361c36bd08e4f541a46b"
        }
      ],
      "source": {
        "advisory": "GHSA-rv8p-rr2h-fgpg",
        "discovery": "UNKNOWN"
      },
      "title": "XSS in @apollo/experimental-nextjs-app-support"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-23841",
    "datePublished": "2024-01-30T17:14:12.023Z",
    "dateReserved": "2024-01-22T22:23:54.343Z",
    "dateUpdated": "2025-06-17T21:29:18.891Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}