GHSA-6FW5-9HQ8-W87G GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

Impact buildWSLegacyExecutor in @graphql-tools/executor-legacy-ws previously hardcoded rejectUnauthorized: false when creating WebSocket connections over WSS. This disabled TLS certificate validation, allowing a network-positioned attacker to perform a Man-in-the-Middle MITM attack against...

@graphql-tools/prisma-loader (>=8.0.0-alpha-20230517123108-df347e95, <=8.0.17-alpha-20241113142246-527bbf8c4e20af3d172439ab4746fe676b3a61c5), @graphql-tools/url-loader (>=8.0.0-alpha-20230517123108-df347e95, <=9.1.9-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a) +1 more potentially affected by CVE-2026-103921 via @graphql-tools/executor-legacy-ws (>=1.0.0-alpha-20230517123108-df347e95, <=1.1.35-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a)

@graphql-tools/executor-legacy-ws NPM version =1.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =9.1.9-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a - graphql-config 5.0.0-alpha-20230519081831-037f0ba Source cves:...

GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

Impact buildWSLegacyExecutor in @graphql-tools/executor-legacy-ws previously hardcoded rejectUnauthorized: false when creating WebSocket connections over WSS. This disabled TLS certificate validation, allowing a network-positioned attacker to perform a Man-in-the-Middle MITM attack against...

EUVD-2026-90922

GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor...

@graphql-tools/prisma-loader (>=8.0.0-alpha-20230517123108-df347e95, <=8.0.17-alpha-20241113142246-527bbf8c4e20af3d172439ab4746fe676b3a61c5), @graphql-tools/url-loader (>=8.0.0-alpha-20230517123108-df347e95, <=9.1.8-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4) +1 more potentially affected by CVE-2026-103921 via @graphql-tools/executor-legacy-ws (>=1.0.0-alpha-20230517123108-df347e95, <=1.1.34-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4)

@graphql-tools/executor-legacy-ws NPM version =1.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =9.1.8-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4 - graphql-config 5.0.0-alpha-20230519081831-037f0ba Source cves:...

GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

Closed by https://github.com/ardatan/graphql-tools/pull/8423 Mitigated in Hive Gateway by https://github.com/graphql-hive/gateway/pull/2600 A client can alias fields to constructor, proto or prototype so that the response keys from two subgraphs collide on those names during result merging. Becau...

@adamwdennis/nestjs-typeorm-cursor-pagination (1.0.0), @ambak/nest-logger (>=1.0.11, <=1.1.0) +209 more potentially affected by CVE-2026-104852 via @graphql-tools/utils (>=12.0.0-alpha-20260805121238-f73ffd0c8126377e841d94b8bb2db97f34af4c41, <=12.0.0)

@graphql-tools/utils NPM version =12.0.0-alpha-20260805121238-f73ffd0c8126377e841d94b8bb2db97f34af4c41, =1.0.11, =0.0.1, =1.0.0, =1.2.5, =3.1.2, =1.0.8, =1.0.0, =1.0.7, =0.0.1, =0.0.73, =0.0.3, =0.0.13, =0.0.1, =0.0.31 and more Source cves: CVE-2026-104852 Source advisory: GHSA-7MX3-VVMW-HJMV...

GHSA-7MX3-VVMW-HJMV GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

Closed by https://github.com/ardatan/graphql-tools/pull/8423 Mitigated in Hive Gateway by https://github.com/graphql-hive/gateway/pull/2600 A client can alias fields to constructor, proto or prototype so that the response keys from two subgraphs collide on those names during result merging. Becau...

@adamwdennis/nestjs-typeorm-cursor-pagination (1.0.0), @ambak/nest-logger (>=1.0.11, <=1.1.0) +210 more potentially affected by CVE-2026-104852 via @graphql-tools/utils (>=12.0.0-alpha-20260805121238-f73ffd0c8126377e841d94b8bb2db97f34af4c41, <=12.0.1-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4)

@graphql-tools/utils NPM version =12.0.0-alpha-20260805121238-f73ffd0c8126377e841d94b8bb2db97f34af4c41, =1.0.11, =0.0.1, =1.0.0, =1.2.5, =3.1.2, =1.0.8, =1.0.0, =1.0.7, =0.0.1, =0.0.73, =0.0.3, =0.0.13, =0.0.1, =0.0.31 and more Source cves: CVE-2026-104852 Source advisory: OSV:GHSA-7MX3-VVMW-HJMV...

CVE-2026-104852 GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude proto, constructor, or prototype keys. An...

CVE-2026-104852

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude proto, constructor, or prototype keys. An...

CVE-2026-104852 GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude proto, constructor, or prototype keys. An...

@adamwdennis/nestjs-typeorm-cursor-pagination (1.0.0), @ambak/nest-logger (>=1.0.11, <=1.1.0) +210 more potentially affected by CVE-2026-104852 via @graphql-tools/utils (>=12.0.0-alpha-20260805121238-f73ffd0c8126377e841d94b8bb2db97f34af4c41, <=12.0.1-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4)

@graphql-tools/utils NPM version =12.0.0-alpha-20260805121238-f73ffd0c8126377e841d94b8bb2db97f34af4c41, =1.0.11, =0.0.1, =1.0.0, =1.2.5, =3.1.2, =1.0.8, =1.0.0, =1.0.7, =0.0.1, =0.0.73, =0.0.3, =0.0.13, =0.0.1, =0.0.31 and more Source cves: CVE-2026-104852 Source advisory: MEND:CVE-2026-104852...

EUVD-2026-92849

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude proto, constructor, or prototype keys. An...

CVE-2026-104852

The GraphQL Tools utils package is vulnerable to prototype pollution in the mergeDeep function prior to version 12.0.1 . The root cause is that the function follows inherited properties and fails to exclude __proto__, constructor, or prototype keys during recursive merging. An unauthenticated Gra...

CVE-2026-104852 GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude proto, constructor, or prototype keys. An...

CVE-2026-105632

Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace including network=0 secret/private projects they were never invited to and grants them a full Member role read + write. The...

CVE-2026-105632 Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects

Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace including network=0 secret/private projects they were never invited to and grants them a full Member role read + write. The...

CVE-2026-105632 Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects

Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace including network=0 secret/private projects they were never invited to and grants them a full Member role read + write. The...

CVE-2026-105632

Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace including network=0 secret/private projects they were never invited to and grants them a full Member role read + write. The...