CVE-2026-103921

HighCVSS 7.4

Published: 01/10/2026(UTC)Updated: 02/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

17th percentile - higher than 17% of all known CVEs

Summary

Prior to version 1.1.35, GraphQL Tools' executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loader with SubscriptionProtocol.LEGACY_WS, can accept an attacker-controlled certificate.

Risk Assessment

A network-positioned attacker can intercept the connection, disclose authentication material in connectionParams or headers, and modify subscription data.

Recommendation

Update GraphQL Tools to version 1.1.35 or later, which fixes this issue.

Other vulnerabilities in GraphQL Tools

CVE-2026-104852High
GraphQL Tools prior to 12.0.1, in the mergeDeep function of the utils package, does not exclude __proto__, constructor, or prototype keys while recursively merging source objects. An unauthenticated GraphQL client can alias fields to those names so responses from two subgraphs collide during ordinary supergraph result merging, causing mergeDeep to traverse Object and Function prototypes and overwrite Function.prototype.call with a subgraph-supplied value. This breaks subsequent requests in the process until restart.

Original NVD description (English source)

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loader with SubscriptionProtocol.LEGACY_WS, can therefore accept an attacker-controlled certificate when a network-positioned attacker intercepts the connection. Authentication material in connectionParams or headers can be disclosed, and subscription data can be modified. Browser WebSocket clients are unaffected because browsers enforce certificate validation. This issue is fixed in version 1.1.35.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS