CVE-2025-27097: Cache variables with the operations when transforms exist on the root level even if variables change in the further requests with the same operation
5.1
CVSS Score
4.0
Basic Information
CVE ID
GHSA ID
EPSS Score
0.30277%
CWE
Published
10/10/2023
Updated
2/28/2025
KEV Status
No
Technology
JavaScript
JavaScriptTechnical Details
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @graphql-mesh/runtime | npm | >= 0.96.5, < 0.96.9 | 0.96.9 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from improper caching of execution requests. The commit diff shows a critical change in useSubschema.ts where the transformedRequestCache (which stored full requests with variables) was replaced with transformedDocumentNodeCache (which only caches DocumentNodes). The original implementation's WeakMap<DocumentNode, {transformedRequest: ExecutionRequest}> would retain initial variables across requests, while the patched version WeakMap<DocumentNode, DocumentNode> only preserves the query structure. This matches the vulnerability description where variables weren't properly refreshed between same-operation requests with transforms.