CVE-2026-118665

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scop...

CVE-2026-118666

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessag...

GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications

Stale authentication state in @graphql-tools/executor-legacy-ws: per-request extensions.connectionParams persist in executor closure state and are replayed in a later caller's connectioninit Report metadata | Field | Value | | --- | --- | | Package | @graphql-tools/executor-legacy-ws npm,...

GHSA-434M-5HCJ-PXF3 GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications

Stale authentication state in @graphql-tools/executor-legacy-ws: per-request extensions.connectionParams persist in executor closure state and are replayed in a later caller's connectioninit Report metadata | Field | Value | | --- | --- | | Package | @graphql-tools/executor-legacy-ws npm,...

GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

Cross-tenant subscription data leak in @graphql-tools/executor-legacy-ws: a shared websocket.onmessage is replaced on every subscribe, and DATA frames are delivered without checking the protocol operation id Report metadata | Field | Value | | --- | --- | | Package |...

GHSA-MP66-8WW2-PCWM GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

Cross-tenant subscription data leak in @graphql-tools/executor-legacy-ws: a shared websocket.onmessage is replaced on every subscribe, and DATA frames are delivered without checking the protocol operation id Report metadata | Field | Value | | --- | --- | | Package |...

CVE-2026-118666

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessag...

EUVD-2026-112473

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessag...

CVE-2026-118666

The @graphql-tools/executor-legacy-ws package (prior to version 1.1.36 ) contains a cross-tenant data leak vulnerability in the buildWSLegacyExecutor component. The root cause is twofold: the executor reuses a single WebSocket and overwrites the websocket.onmessage handler on every new subscripti...

CVE-2026-118666 GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessag...

CVE-2026-118666 GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessag...

CVE-2026-118665

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scop...

EUVD-2026-112472

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scop...

CVE-2026-118665

The @graphql-tools/executor-legacy-ws package is vulnerable to stale authentication state persistence due to a flaw in the buildWSLegacyExecutor component. Specifically, the executorConnectionParams object in packages/executors/legacy-ws/src/index.ts retains values from request.extensions.connect...

CVE-2026-118665 GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scop...

CVE-2026-118665 GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scop...

ROOT-APP-NPM-CVE-2026-114604 CVE-2026-114604 in @graphql-tools/utils - Patched by Root

Root has patched CVE-2026-114604 in the @graphql-tools/utils package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-104852 CVE-2026-104852 in @graphql-tools/utils - Patched by Root

Root has patched CVE-2026-104852 in the @graphql-tools/utils package for Root:npm. Multiple fixed versions available...

CVE-2026-118666: Exposure of Sensitive Information to an Unauthorized Actor

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessag...

PT-2026-129187

Name of the Vulnerable Software and Affected Versions @graphql-tools/executor-legacy-ws versions prior to 1.1.36 Description In the buildWSLegacyExecutor function, the software reuses a single WebSocket and replaces its websocket.onmessage handler whenever a new overlapping subscription starts. T...