Skip to content
OpenAdvisories

Vendor

ardatan

7 known vulnerabilities.

Products

graphql-tools 5 graphql-mesh 2
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.4
    CVE-2026-114604

    GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

    GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. From 10.10.1 until 12.0.2, the @graphql-tools/utils mergeIncrementalResult helper passes incrementalResult.path segments to setObjectKeyPath without runtime primitive-type …

    ardatan graphql-tools @graphql-tools/utils npm
  • High 8.2
    CVE-2026-118665

    GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications

    GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extension…

    ardatan @graphql-tools graphql-tools executor-legacy-ws npm
  • High 8.2
    CVE-2026-104852

    GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

    GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude __proto__, …

    ardatan graphql-tools langfuse-3-worker @graphql-tools/utils Wolfi npm
  • High 7.4
    CVE-2026-103921

    GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

    GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications u…

    ardatan @graphql-tools graphql-tools executor-legacy-ws npm