Skip to content
OpenAdvisories

Vendor

@graphql-tools

3 known vulnerabilities.

Products

executor-legacy-ws 3
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.2
    CVE-2026-118665

    GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications

    GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extension…

    ardatan @graphql-tools graphql-tools executor-legacy-ws npm
  • High 7.4
    CVE-2026-103921

    GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

    GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications u…

    ardatan @graphql-tools graphql-tools executor-legacy-ws npm