ROOT-APP-NPM-CVE-2026-103921 CVE-2026-103921 in @graphql-tools/executor-legacy-ws - Patched by Root

Root has patched CVE-2026-103921 in the @graphql-tools/executor-legacy-ws package for Root:npm. Multiple fixed versions available...

GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

Impact buildWSLegacyExecutor in @graphql-tools/executor-legacy-ws previously hardcoded rejectUnauthorized: false when creating WebSocket connections over WSS. This disabled TLS certificate validation, allowing a network-positioned attacker to perform a Man-in-the-Middle MITM attack against...

GHSA-6FW5-9HQ8-W87G GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

Impact buildWSLegacyExecutor in @graphql-tools/executor-legacy-ws previously hardcoded rejectUnauthorized: false when creating WebSocket connections over WSS. This disabled TLS certificate validation, allowing a network-positioned attacker to perform a Man-in-the-Middle MITM attack against...

@graphql-tools/prisma-loader (>=8.0.0-alpha-20230517123108-df347e95, <=8.0.17-alpha-20241113142246-527bbf8c4e20af3d172439ab4746fe676b3a61c5), @graphql-tools/url-loader (>=8.0.0-alpha-20230517123108-df347e95, <=9.1.9-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a) +1 more potentially affected by CVE-2026-103921 via @graphql-tools/executor-legacy-ws (>=1.0.0-alpha-20230517123108-df347e95, <=1.1.35-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a)

@graphql-tools/executor-legacy-ws NPM version =1.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =9.1.9-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a - graphql-config 5.0.0-alpha-20230519081831-037f0ba Source cves:...

@graphql-tools/prisma-loader (>=8.0.0-alpha-20230517123108-df347e95, <=8.0.17-alpha-20241113142246-527bbf8c4e20af3d172439ab4746fe676b3a61c5), @graphql-tools/url-loader (>=8.0.0-alpha-20230517123108-df347e95, <=9.1.8-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4) +1 more potentially affected by CVE-2026-103921 via @graphql-tools/executor-legacy-ws (>=1.0.0-alpha-20230517123108-df347e95, <=1.1.34-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4)

@graphql-tools/executor-legacy-ws NPM version =1.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =9.1.8-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4 - graphql-config 5.0.0-alpha-20230519081831-037f0ba Source cves:...

Improper Certificate Validation

Overview @graphql-tools/executor-legacy-ws is an A set of utils for faster development of GraphQL tools Affected versions of this package are vulnerable to Improper Certificate Validation via a hardcoded rejectUnauthorized: false in buildWSLegacyExecutor, which unconditionally disables TLS...

@graphql-tools/prisma-loader (>=8.0.0-alpha-20230517123108-df347e95, <=8.0.17-alpha-20241113142246-527bbf8c4e20af3d172439ab4746fe676b3a61c5), @graphql-tools/url-loader (>=8.0.0-alpha-20230517123108-df347e95, <=9.1.9-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a) +1 more potentially affected by CVE-2026-103921 via @graphql-tools/executor-legacy-ws (>=1.0.0-alpha-20230517123108-df347e95, <=1.1.35-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a)

@graphql-tools/executor-legacy-ws NPM version =1.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =9.1.9-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a - graphql-config 5.0.0-alpha-20230519081831-037f0ba Source cves:...

02strich-markdown (>=1.0.0, <=1.0.2), 0xsodium (>=0.2.0, <=0.14.0) +774 more potentially affected by CVE-2026-103921 via @graphql-tools/executor-legacy-ws (>=0.0.1-alpha-20221108142800-3beb5fe2, <=1.1.35-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a)

@graphql-tools/executor-legacy-ws NPM version =0.0.1-alpha-20221108142800-3beb5fe2, =1.0.0, =0.2.0, =0.0.1-b, =0.2.0, =0.2.0, =0.5.2, =5.0.2, =2.2.0, =1.1.4, =1.3.1, =1.0.0, =0.0.2-alpha-20220914223128-d706aab, =0.0.2-alpha-20220915073207-1bb0680, =0.0.2-alpha-20221101100428-eb8da76 and more Sour...