@graphql-tools/prisma-loader (>=8.0.0-alpha-20230517123108-df347e95, <=8.0.17-alpha-20241113142246-527bbf8c4e20af3d172439ab4746fe676b3a61c5), @graphql-tools/url-loader (>=8.0.0-alpha-20230517123108-df347e95, <=9.1.8-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4) +1 more potentially affected by CVE-2026-103921 via @graphql-tools/executor-legacy-ws (>=1.0.0-alpha-20230517123108-df347e95, <=1.1.34-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4)

@graphql-tools/executor-legacy-ws NPM version =1.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =9.1.8-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4 - graphql-config 5.0.0-alpha-20230519081831-037f0ba Source cves:...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation via a hardcoded rejectUnauthorized: false in buildWSLegacyExecutor, which unconditionally disables TLS certificate validation for all wss:// connections and cannot be overridden by callers. An attacker...