CVE-2026-118665

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scop...

CVE-2026-118666

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessag...

GHSA-434M-5HCJ-PXF3 GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications

Stale authentication state in @graphql-tools/executor-legacy-ws: per-request extensions.connectionParams persist in executor closure state and are replayed in a later caller's connectioninit Report metadata | Field | Value | | --- | --- | | Package | @graphql-tools/executor-legacy-ws npm,...

GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications

Stale authentication state in @graphql-tools/executor-legacy-ws: per-request extensions.connectionParams persist in executor closure state and are replayed in a later caller's connectioninit Report metadata | Field | Value | | --- | --- | | Package | @graphql-tools/executor-legacy-ws npm,...

GHSA-MP66-8WW2-PCWM GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

Cross-tenant subscription data leak in @graphql-tools/executor-legacy-ws: a shared websocket.onmessage is replaced on every subscribe, and DATA frames are delivered without checking the protocol operation id Report metadata | Field | Value | | --- | --- | | Package |...

GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

Cross-tenant subscription data leak in @graphql-tools/executor-legacy-ws: a shared websocket.onmessage is replaced on every subscribe, and DATA frames are delivered without checking the protocol operation id Report metadata | Field | Value | | --- | --- | | Package |...

CVE-2026-118666

The @graphql-tools/executor-legacy-ws package (prior to version 1.1.36 ) contains a cross-tenant data leak vulnerability in the buildWSLegacyExecutor component. The root cause is twofold: the executor reuses a single WebSocket and overwrites the websocket.onmessage handler on every new subscripti...

CVE-2026-118666 GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessag...

EUVD-2026-112473

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessag...

CVE-2026-118666 GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessag...

CVE-2026-118666

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessag...

EUVD-2026-112472

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scop...

CVE-2026-118665

The @graphql-tools/executor-legacy-ws package is vulnerable to stale authentication state persistence due to a flaw in the buildWSLegacyExecutor component. Specifically, the executorConnectionParams object in packages/executors/legacy-ws/src/index.ts retains values from request.extensions.connect...

PT-2026-129187

Name of the Vulnerable Software and Affected Versions @graphql-tools/executor-legacy-ws versions prior to 1.1.36 Description In the buildWSLegacyExecutor function, the software reuses a single WebSocket and replaces its websocket.onmessage handler whenever a new overlapping subscription starts. T...

CVE-2026-118665: Insufficient Session Expiration

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scop...

CVE-2026-118666: Exposure of Sensitive Information to an Unauthorized Actor

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessag...

EUVD-2026-90922

GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor...

Improper Certificate Validation

Overview @graphql-tools/executor-legacy-ws is an A set of utils for faster development of GraphQL tools Affected versions of this package are vulnerable to Improper Certificate Validation via a hardcoded rejectUnauthorized: false in buildWSLegacyExecutor, which unconditionally disables TLS...

CVE-2026-103921 GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...

CVE-2026-103921

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...