Skip to content
OpenAdvisories

Package · npm

@graphql-tools/executor-legacy-ws

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 6.0
    CVE-2026-118666

    GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

    GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and …

    ardatan @graphql-tools graphql-tools executor-legacy-ws npm
  • High 8.2
    CVE-2026-118665

    GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications

    GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extension…

    ardatan @graphql-tools graphql-tools executor-legacy-ws npm
  • High 7.4
    CVE-2026-103921

    GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

    GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications u…

    ardatan @graphql-tools graphql-tools executor-legacy-ws npm