Skip to content
OpenAdvisories

Vendor

ardatan

7 known vulnerabilities.

Products

graphql-tools 5 graphql-mesh 2
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.0
    CVE-2026-118666

    GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

    GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and …

    ardatan @graphql-tools graphql-tools executor-legacy-ws npm
  • Medium 5.1
    CVE-2025-27097

    Cache variables with the operations when transforms exist on the root level even if variables change in the further requests with the same operation

    GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. When a user transforms on the …

    ardatan graphql-mesh @graphql-mesh/runtime npm
  • Medium 5.8
    CVE-2025-27098

    Unwanted access to the entire file system vulnerability due to a missing check in `staticFiles` HTTP handler in graphql-mesh

    GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. Missing check vulnerability in…

    ardatan graphql-mesh @graphql-mesh/cli @graphql-mesh/http npm