CVE-2026-118665

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scop...

CVE-2026-118666

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessag...

EUVD-2026-112473

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessag...

CVE-2026-118666

The @graphql-tools/executor-legacy-ws package (prior to version 1.1.36 ) contains a cross-tenant data leak vulnerability in the buildWSLegacyExecutor component. The root cause is twofold: the executor reuses a single WebSocket and overwrites the websocket.onmessage handler on every new subscripti...

CVE-2026-118666 GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessag...

CVE-2026-118665

The @graphql-tools/executor-legacy-ws package is vulnerable to stale authentication state persistence due to a flaw in the buildWSLegacyExecutor component. Specifically, the executorConnectionParams object in packages/executors/legacy-ws/src/index.ts retains values from request.extensions.connect...

EUVD-2026-112472

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scop...

CVE-2026-118665 GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scop...