graphql-tools executor-legacy-ws vulnerabilities

Latest graphql-tools executor-legacy-ws CVEs

Newest publication first

1. CVE-2026-118666 GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

   Published 2026-10-28

   Medium·CVSS 6.0 EPSS 0.34%

   GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single w...

2. CVE-2026-118665 GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications

   Published 2026-10-28

   High·CVSS 8.2 EPSS 0.39%

   GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in...

3. CVE-2026-103921 GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

   Published 2026-10-01

   High·CVSS 7.4 EPSS 0.27%

   GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor dir...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.