graphql-tools vulnerabilities

Products

• executor-legacy-ws 3
• @graphql-tools/utils 2
• @graphql-tools/git-loader 1

Latest graphql-tools CVEs

Newest publication first

1. CVE-2026-114604 GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

   Published 2026-11-05

   High·CVSS 8.4 EPSS 0.52%

   GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. From 10.10.1 until 12.0.2, the @graphql-tools/utils mergeIncrementalResult helper passes incrementalResult.path segments to setObjectKeyPath without runtime primitive-type validation. A non-pri...

2. CVE-2026-118666 GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

   Published 2026-10-28

   Medium·CVSS 6.0

   GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single w...

3. CVE-2026-118665 GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications

   Published 2026-10-28

   High·CVSS 8.2

   GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in...

4. CVE-2026-104852 GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

   Published 2026-10-05

   High·CVSS 8.2 EPSS 0.45%

   GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude proto, constructor, or prototype...

5. CVE-2026-103921 GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

   Published 2026-10-01

   High·CVSS 7.4

   GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor dir...

6. CVE-2021-23326 Command Injection

   Published 2021-01-20

   High·CVSS 8.8 EPSS 2.8%

   This affects the package @graphql-tools/git-loader before 6.2.6. The use of exec and execSync in packages/loaders/git/src/load-git.ts allows arbitrary command injection.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.