{"action":"Upgrade @graphql-tools/executor-legacy-ws to 1.1.35 or later.","affected":[{"fixed":"1.1.35","introduced":"0"}],"component":"@graphql-tools/executor-legacy-ws","cve_ids":["CVE-2026-103921"],"ecosystem":"npm","epss":0.00268,"exploited":false,"fixed_versions":["1.1.35"],"ghsa_id":"GHSA-6fw5-9hq8-w87g","id":"tcs_01M5KF6VRPDWAGE5QTG7QXVER6","modified_at":"2026-10-05T23:15:03.996305160Z","published_at":"2026-10-05T22:56:56Z","references":["https://osv.dev/vulnerability/GHSA-6fw5-9hq8-w87g","https://github.com/ardatan/graphql-tools/security/advisories/GHSA-6fw5-9hq8-w87g","https://nvd.nist.gov/vuln/detail/CVE-2026-103921","https://github.com/ardatan/graphql-tools/pull/8426","https://github.com/ardatan/graphql-tools/commit/3831a0661514c91d99971052f983552556880402","https://github.com/ardatan/graphql-tools","https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/executor-legacy-ws@1.1.35"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"GHSA-6fw5-9hq8-w87g","url":"https://osv.dev/vulnerability/GHSA-6fw5-9hq8-w87g"}],"summary":"GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor"}