npm/@graphql-tools/executor-legacy-ws CVE-2026-103921: high 7.4, EPSS 0.27%
GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
Action: Upgrade @graphql-tools/executor-legacy-ws to 1.1.35 or later.
npm i @graphql-tools/executor-legacy-ws@1.1.35Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.1.35 | - |
Fixed versions
| 1.1.35 |
Sources
- osv: GHSA-6fw5-9hq8-w87g
- https://github.com/ardatan/graphql-tools/security/advisories/GHSA-6fw5-9hq8-w87g
- https://nvd.nist.gov/vuln/detail/CVE-2026-103921
- https://github.com/ardatan/graphql-tools/pull/8426
- https://github.com/ardatan/graphql-tools/commit/3831a0661514c91d99971052f983552556880402
- https://github.com/ardatan/graphql-tools
- https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/executor-legacy-ws@1.1.35
CVE-2026-103921 · published · modified · JSON