CyberSecBulletin

@graphql-tools vulnerabilities

We track 2 vulnerabilities in @graphql-tools products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 28, 2026.

2vulnerabilities
0critical
2high
0exploited
7.8average CVSS score

Latest @graphql-tools vulnerabilities

  • 8.2 High severity

    GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas.

    CVE-2026-118665Ardatan

    GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions

  • 7.4 High severity

    graphql-tools: Improper Certificate Validation

    CVE-2026-103921Ardatan

    GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications us