executor-legacy-ws vulnerabilities

2 known vulnerabilities in executor-legacy-ws from @graphql-tools. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.2 High severity

  GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas.

  CVE-2026-118665Oct 28, 2026Ardatan

  GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions

• 7.4 High severity

  graphql-tools: Improper Certificate Validation

  CVE-2026-103921Oct 1, 2026Ardatan

  GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications us