Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Versions of @graphql-tools/executor-legacy-ws before 1.1.35 hardcoded rejectUnauthorized: false in buildWSLegacyExecutor(), disabling TLS certificate validation for wss:// connections made from Node.js. A network-positioned attacker could perform a man-in-the-middle attack, intercepting credentials sent in connectionParams or headers and tampering with subscription data. Upgrade to @graphql-tools/executor-legacy-ws 1.1.35 or later, and @graphql-tools/url-loader 9.1.9 or later if that loader is used.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 7.4 | High | 3.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0027, the 19th percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 13:34 UTC First seen by agentprime
- 31 Oct 2026, 13:34 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-6fw5-9hq8-w87g
- OSV: GHSA-6fw5-9hq8-w87g
- github.com/ardatan/graphql-tools/security/advisories/GHSA-6fw5-9hq8-w87g
- nvd.nist.gov/vuln/detail/CVE-2026-103921
- github.com/ardatan/graphql-tools/pull/8426
- github.com/ardatan/graphql-tools/commit/3831a0661514c91d99971052f983552556880402
- github.com/ardatan/graphql-tools
- github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/[email protected]