3vulnerabilities
- Critical0 (0.0%)
- High2 (66.7%)
- Medium0 (0.0%)
- Moderate1 (33.3%)
- Low0 (0.0%)
graphql-tools-executor-legacy-ws
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 2HighAffects 2 versions
- 0MediumAffects 0 versions
- 1ModerateAffects 1 version
- 0LowAffects 0 versions
Monthly breakdown
- 3 vulnerabilities
- Critical: 0
- High: 2
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (3)
Known vulnerabilities affecting graphql-tools-executor-legacy-ws, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-434m-5hcj-pxf3 | High | GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications# Stale authentication state in `@graphql-tools/executor-legacy-ws`: per-request `extensions.connectionParams` persist in executor closure state and are replayed in a later caller's `connection_init` ## Report metadata | Field | Value | | --- | --- | | Package | `@graphql-tools/executor-legacy-ws` (npm, `pkg:npm/%40graphql-tools/executor-legacy-ws`) | | Repository | https://github.com/ardatan/graphql-tools | | Component | `buildWSLegacyExecutor` (`packages/executors/legacy-ws/src/index.ts`) | | Vulnerability class | Stale authentication state / credential reuse across requests | | Verified a |
| GitHub (opens in a new tab) | |
| GHSA-mp66-8ww2-pcwm | Moderate | GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller# Cross-tenant subscription data leak in `@graphql-tools/executor-legacy-ws`: a shared `websocket.onmessage` is replaced on every `subscribe()`, and `DATA` frames are delivered without checking the protocol operation id ## Report metadata | Field | Value | | --- | --- | | Package | `@graphql-tools/executor-legacy-ws` (npm, `pkg:npm/%40graphql-tools/executor-legacy-ws`) | | Repository | https://github.com/ardatan/graphql-tools | | Component | `buildWSLegacyExecutor` → the returned executor's `subscribe(observer)` / `websocket.onmessage` handler | | Vulnerability class | Cross-tenant data leak |
| GitHub (opens in a new tab) | |
| GHSA-6fw5-9hq8-w87g | High | GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor## Impact `buildWSLegacyExecutor()` in `@graphql-tools/executor-legacy-ws` previously hardcoded `rejectUnauthorized: false` when creating WebSocket connections over WSS. This disabled TLS certificate validation, allowing a network-positioned attacker to perform a Man-in-the-Middle (MITM) attack against applications that use this executor with a `wss://` endpoint. Credentials passed via `connectionParams` or `headers` could be intercepted, and subscription data could be tampered with. **Who is impacted:** Applications using `@graphql-tools/executor-legacy-ws` (directly or via `@graphql-tools/ |
| GitHub (opens in a new tab) |
- GHSA-434m-5hcj-pxf3HighGraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications
< 1.1.36
# Stale authentication state in `@graphql-tools/executor-legacy-ws`: per-request `extensions.connectionParams` persist in executor closure state and are replayed in a later caller's `connection_init` ## Report metadata | Field | Value | | --- | --- | | Package | `@graphql-tools/executor-legacy-ws` (npm, `pkg:npm/%40graphql-tools/executor-legacy-ws`) | | Repository | https://github.com/ardatan/graphql-tools | | Component | `buildWSLegacyExecutor` (`packages/executors/legacy-ws/src/index.ts`) | | Vulnerability class | Stale authentication state / credential reuse across requests | | Verified a
CVE: CVE-2026-118665
- GHSA-mp66-8ww2-pcwmModerateGraphQL Tools: Shared legacy executor routes one subscription's results to a different caller
< 1.1.36
# Cross-tenant subscription data leak in `@graphql-tools/executor-legacy-ws`: a shared `websocket.onmessage` is replaced on every `subscribe()`, and `DATA` frames are delivered without checking the protocol operation id ## Report metadata | Field | Value | | --- | --- | | Package | `@graphql-tools/executor-legacy-ws` (npm, `pkg:npm/%40graphql-tools/executor-legacy-ws`) | | Repository | https://github.com/ardatan/graphql-tools | | Component | `buildWSLegacyExecutor` → the returned executor's `subscribe(observer)` / `websocket.onmessage` handler | | Vulnerability class | Cross-tenant data leak
CVE: CVE-2026-118666
- GHSA-6fw5-9hq8-w87gHighGraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
< 1.1.35
## Impact `buildWSLegacyExecutor()` in `@graphql-tools/executor-legacy-ws` previously hardcoded `rejectUnauthorized: false` when creating WebSocket connections over WSS. This disabled TLS certificate validation, allowing a network-positioned attacker to perform a Man-in-the-Middle (MITM) attack against applications that use this executor with a `wss://` endpoint. Credentials passed via `connectionParams` or `headers` could be intercepted, and subscription data could be tampered with. **Who is impacted:** Applications using `@graphql-tools/executor-legacy-ws` (directly or via `@graphql-tools/
CVE: CVE-2026-103921