CVE-2026-118666

A flaw was found in the GraphQL Tools legacy WebSocket executor. When handling concurrent subscriptions, the executor reuses a single WebSocket connection and replaces the active message handler without validating incoming subscription operation identifiers. A user sharing the executor can exploi...