# What changed in @apollo/server

> 4 changes in @apollo/server 5 from its official release notes, upgrade guides and advisories: 2 breaking, 2 security. Each one cited. Sources checked 2026-10-24. HTML: https://unstale.sh/npm/@apollo/server/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @apollo/server 5

### Breaking changes

- In @apollo/server/standalone, GraphQL GET requests with a Content-Type other than application/json (optionally with parameters) are rejected with status 415, strengthening CSRF protection. (5.5.0) — [release notes](https://github.com/apollographql/apollo-server/releases/tag/%40apollo/server%405.5.0)
- Request bodies now accept only UTF-8, UTF-16 (LE or BE), or UTF-32 (LE or BE); other character sets are rejected with a 415 Unsupported Media Type error, addressing a denial-of-service vulnerability. (5.4.0) — [release notes](https://github.com/apollographql/apollo-server/releases/tag/%40apollo/server%405.4.0)

### Security

- Apollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention (5.5.0) — [security advisory](https://github.com/advisories/GHSA-9Q82-XGWF-VJ6H)
- Apollo Serve vulnerable to Denial of Service with `startStandaloneServer` (4.13.0, 5.4.0) — [security advisory](https://github.com/advisories/GHSA-MP6Q-XF9X-FWF7)