@graphql-tools/prisma-loader (>=8.0.0-alpha-20230517123108-df347e95, <=8.0.17-alpha-20241113142246-527bbf8c4e20af3d172439ab4746fe676b3a61c5), @graphql-tools/url-loader (>=8.0.0-alpha-20230517123108-df347e95, <=9.1.11-alpha-20260930213106-001ad6da4923b8bb612d81d5418e51f7365e603b) +1 more potentially affected by CVE-2026-118666 via @graphql-tools/executor-legacy-ws (>=1.0.0-alpha-20230517123108-df347e95, <=1.1.36-alpha-20260930213106-001ad6da4923b8bb612d81d5418e51f7365e603b)

@graphql-tools/executor-legacy-ws NPM version =1.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =9.1.11-alpha-20260930213106-001ad6da4923b8bb612d81d5418e51f7365e603b - graphql-config 5.0.0-alpha-20230519081831-037f0ba Source cves:...

CVE-2026-118666

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessag...

CVE-2026-118665

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scop...

GHSA-X8RM-F576-GQ67 graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service

Summary The regular expression behind GraphQLPhoneNumber since 1.24.1 backtracks exponentially. A string made of a run of digits followed by one character that makes the match fail for example "1".repeat30 + "x" blocks the JavaScript thread for seconds, and every additional digit doubles the time...

EUVD-2026-109185

graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service...

@0day-network/mod-renderer (>=0.1.0, <=0.1.1), @0day-network/react-sdk (>=0.0.1, <=0.2.1) +1013 more potentially affected by CVE-2026-115887 via graphql-scalars (>=1.24.1, <=2.0.0)

graphql-scalars NPM version =1.24.1, =0.1.0, =0.0.1, =1.0.21, =0.0.1-b, =0.2.1-alpha-20230314092928-a653bb0, =0.1.0-alpha-20230314092928-a653bb0, =0.1.0-alpha-20230314092928-a653bb0, =0.6.0, =0.2.0, =0.2.0, =0.0.0, =0.9.1, =0.0.1, =0.0.0, =0.0.941 - @adobe-apimesh/mesh-builder 1.4.0-beta.5 and mo...

npm: graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service

npm: graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service vulnerability discovered by ? in WordPress npm graphql-scalars versions = 1.24.1, = 2.0.0...

graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service

Summary The regular expression behind GraphQLPhoneNumber since 1.24.1 backtracks exponentially. A string made of a run of digits followed by one character that makes the match fail for example "1".repeat30 + "x" blocks the JavaScript thread for seconds, and every additional digit doubles the time...

@0day-network/mod-renderer (>=0.1.0, <=0.1.1), @0day-network/react-sdk (>=0.0.1, <=0.2.1) +1013 more potentially affected by CVE-2026-115887 via graphql-scalars (>=1.24.1, <=2.0.0)

graphql-scalars NPM version =1.24.1, =0.1.0, =0.0.1, =1.0.21, =0.0.1-b, =0.2.1-alpha-20230314092928-a653bb0, =0.1.0-alpha-20230314092928-a653bb0, =0.1.0-alpha-20230314092928-a653bb0, =0.6.0, =0.2.0, =0.2.0, =0.0.0, =0.9.1, =0.0.1, =0.0.0, =0.0.941 - @adobe-apimesh/mesh-builder 1.4.0-beta.5 and mo...

GHSA-434M-5HCJ-PXF3 GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications

Stale authentication state in @graphql-tools/executor-legacy-ws: per-request extensions.connectionParams persist in executor closure state and are replayed in a later caller's connectioninit Report metadata | Field | Value | | --- | --- | | Package | @graphql-tools/executor-legacy-ws npm,...

GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications

Stale authentication state in @graphql-tools/executor-legacy-ws: per-request extensions.connectionParams persist in executor closure state and are replayed in a later caller's connectioninit Report metadata | Field | Value | | --- | --- | | Package | @graphql-tools/executor-legacy-ws npm,...

@graphql-tools/prisma-loader (>=8.0.0-alpha-20230517123108-df347e95, <=8.0.17-alpha-20241113142246-527bbf8c4e20af3d172439ab4746fe676b3a61c5), @graphql-tools/url-loader (>=8.0.0-alpha-20230517123108-df347e95, <=9.1.11-alpha-20260930213106-001ad6da4923b8bb612d81d5418e51f7365e603b) +1 more potentially affected by CVE-2026-118665 via @graphql-tools/executor-legacy-ws (>=1.0.0-alpha-20230517123108-df347e95, <=1.1.36-alpha-20260930213106-001ad6da4923b8bb612d81d5418e51f7365e603b)

@graphql-tools/executor-legacy-ws NPM version =1.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =9.1.11-alpha-20260930213106-001ad6da4923b8bb612d81d5418e51f7365e603b - graphql-config 5.0.0-alpha-20230519081831-037f0ba Source cves:...

@graphql-tools/prisma-loader (>=8.0.0-alpha-20230517123108-df347e95, <=8.0.17-alpha-20241113142246-527bbf8c4e20af3d172439ab4746fe676b3a61c5), @graphql-tools/url-loader (>=8.0.0-alpha-20230517123108-df347e95, <=9.1.9-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a) +1 more potentially affected by CVE-2026-118665 via @graphql-tools/executor-legacy-ws (>=1.0.0-alpha-20230517123108-df347e95, <=1.1.35-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a)

@graphql-tools/executor-legacy-ws NPM version =1.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =9.1.9-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a - graphql-config 5.0.0-alpha-20230519081831-037f0ba Source cves:...

GHSA-MP66-8WW2-PCWM GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

Cross-tenant subscription data leak in @graphql-tools/executor-legacy-ws: a shared websocket.onmessage is replaced on every subscribe, and DATA frames are delivered without checking the protocol operation id Report metadata | Field | Value | | --- | --- | | Package |...

@graphql-tools/prisma-loader (>=8.0.0-alpha-20230517123108-df347e95, <=8.0.17-alpha-20241113142246-527bbf8c4e20af3d172439ab4746fe676b3a61c5), @graphql-tools/url-loader (>=8.0.0-alpha-20230517123108-df347e95, <=9.1.9-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a) +1 more potentially affected by CVE-2026-118666 via @graphql-tools/executor-legacy-ws (>=1.0.0-alpha-20230517123108-df347e95, <=1.1.35-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a)

@graphql-tools/executor-legacy-ws NPM version =1.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =9.1.9-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a - graphql-config 5.0.0-alpha-20230519081831-037f0ba Source cves:...

@graphql-tools/prisma-loader (>=8.0.0-alpha-20230517123108-df347e95, <=8.0.17-alpha-20241113142246-527bbf8c4e20af3d172439ab4746fe676b3a61c5), @graphql-tools/url-loader (>=8.0.0-alpha-20230517123108-df347e95, <=9.1.11-alpha-20260930213106-001ad6da4923b8bb612d81d5418e51f7365e603b) +1 more potentially affected by CVE-2026-118666 via @graphql-tools/executor-legacy-ws (>=1.0.0-alpha-20230517123108-df347e95, <=1.1.36-alpha-20260930213106-001ad6da4923b8bb612d81d5418e51f7365e603b)

@graphql-tools/executor-legacy-ws NPM version =1.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =9.1.11-alpha-20260930213106-001ad6da4923b8bb612d81d5418e51f7365e603b - graphql-config 5.0.0-alpha-20230519081831-037f0ba Source cves:...

GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

Cross-tenant subscription data leak in @graphql-tools/executor-legacy-ws: a shared websocket.onmessage is replaced on every subscribe, and DATA frames are delivered without checking the protocol operation id Report metadata | Field | Value | | --- | --- | | Package |...

CVE-2026-118666

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessag...

CVE-2026-118666

The @graphql-tools/executor-legacy-ws package (prior to version 1.1.36 ) contains a cross-tenant data leak vulnerability in the buildWSLegacyExecutor component. The root cause is twofold: the executor reuses a single WebSocket and overwrites the websocket.onmessage handler on every new subscripti...

CVE-2026-118666 GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessag...