5915 matches found
CVE-2026-118666 GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessag...
@graphql-tools/prisma-loader (>=8.0.3-alpha-20240222154539-b27ae8605c354eed2b24844a475c8889ccc90dfb, <=8.0.17-alpha-20241113142246-527bbf8c4e20af3d172439ab4746fe676b3a61c5), @graphql-tools/url-loader (>=8.0.2-alpha-20240222154539-b27ae8605c354eed2b24844a475c8889ccc90dfb, <=9.1.11-alpha-20260930213106-001ad6da4923b8bb612d81d5418e51f7365e603b) potentially affected by CVE-2026-118666 via @graphql-tools/executor-legacy-ws (>=1.0.6-alpha-20240222154539-b27ae8605c354eed2b24844a475c8889ccc90dfb, <=1.1.36-alpha-20260930213106-001ad6da4923b8bb612d81d5418e51f7365e603b)
@graphql-tools/executor-legacy-ws NPM version =1.0.6-alpha-20240222154539-b27ae8605c354eed2b24844a475c8889ccc90dfb, =8.0.3-alpha-20240222154539-b27ae8605c354eed2b24844a475c8889ccc90dfb, =8.0.2-alpha-20240222154539-b27ae8605c354eed2b24844a475c8889ccc90dfb,...
EUVD-2026-112473
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessag...
CVE-2026-118666 GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessag...
CVE-2026-118665
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scop...
CVE-2026-118665
The @graphql-tools/executor-legacy-ws package is vulnerable to stale authentication state persistence due to a flaw in the buildWSLegacyExecutor component. Specifically, the executorConnectionParams object in packages/executors/legacy-ws/src/index.ts retains values from request.extensions.connect...
CVE-2026-118665 GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scop...
CVE-2026-118665 GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scop...
EUVD-2026-112472
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scop...
@graphql-tools/prisma-loader (>=8.0.3-alpha-20240222154539-b27ae8605c354eed2b24844a475c8889ccc90dfb, <=8.0.17-alpha-20241113142246-527bbf8c4e20af3d172439ab4746fe676b3a61c5), @graphql-tools/url-loader (>=8.0.2-alpha-20240222154539-b27ae8605c354eed2b24844a475c8889ccc90dfb, <=9.1.11-alpha-20260930213106-001ad6da4923b8bb612d81d5418e51f7365e603b) potentially affected by CVE-2026-118665 via @graphql-tools/executor-legacy-ws (>=1.0.6-alpha-20240222154539-b27ae8605c354eed2b24844a475c8889ccc90dfb, <=1.1.36-alpha-20260930213106-001ad6da4923b8bb612d81d5418e51f7365e603b)
@graphql-tools/executor-legacy-ws NPM version =1.0.6-alpha-20240222154539-b27ae8605c354eed2b24844a475c8889ccc90dfb, =8.0.3-alpha-20240222154539-b27ae8605c354eed2b24844a475c8889ccc90dfb, =8.0.2-alpha-20240222154539-b27ae8605c354eed2b24844a475c8889ccc90dfb,...
Stack overflow on deeply nested GraphQL documents
The parser of juniper called itself once for each level of nesting in a GraphQL document. The parser had no limit on the nesting depth. Deeply nested selection sets, input values, and list types thus overflowed the stack of the thread that parsed the document. Validation and execution followed...
Excessive CPU and memory use on crafted GraphQL documents
Several parts of juniper did work that grew faster than the size of the GraphQL document. A small document could thus use seconds of CPU time or gigabytes of memory. The requests need no authentication. - OverlappingFieldsCanBeMerged compared all pairs of fields with the same response name. The...
Unbounded memory use on large request bodies
The graphql and graphqlsync functions of juniperhyper read the whole body of a POST request into memory before they parsed the body. The functions had no limit on the size of the body. A client could thus send a large body and exhaust the memory of the server. The request needs no authentication...
RUSTSEC-2026-0416 Stack overflow on deeply nested GraphQL documents
The parser of juniper called itself once for each level of nesting in a GraphQL document. The parser had no limit on the nesting depth. Deeply nested selection sets, input values, and list types thus overflowed the stack of the thread that parsed the document. Validation and execution followed...
RUSTSEC-2026-0415 Unbounded memory use on large request bodies
The graphql and graphqlsync functions of juniperhyper read the whole body of a POST request into memory before they parsed the body. The functions had no limit on the size of the body. A client could thus send a large body and exhaust the memory of the server. The request needs no authentication...
RUSTSEC-2026-0417 Excessive CPU and memory use on crafted GraphQL documents
Several parts of juniper did work that grew faster than the size of the GraphQL document. A small document could thus use seconds of CPU time or gigabytes of memory. The requests need no authentication. - OverlappingFieldsCanBeMerged compared all pairs of fields with the same response name. The...
ROOT-APP-NPM-CVE-2026-104852 CVE-2026-104852 in @graphql-tools/utils - Patched by Root
Root has patched CVE-2026-104852 in the @graphql-tools/utils package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-114604 CVE-2026-114604 in @graphql-tools/utils - Patched by Root
Root has patched CVE-2026-114604 in the @graphql-tools/utils package for Root:npm. Multiple fixed versions available...