EUVD-2026-90922
GHSA-6fw5-9hq8-w87g
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
AC:H because a man-in-the-middle position is required; PR:N/UI:N as no victim credentials or interaction are needed; C:H/I:H for credential disclosure and subscription tampering, A:N as availability is unaffected.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loader with SubscriptionProtocol.LEGACY_WS, can therefore accept an attacker-controlled certificate when a network-positioned attacker intercepts the connection. Authentication material in connectionParams or headers can be disclosed, and subscription data can be modified. Browser WebSocket clients are unaffected because browsers enforce certificate validation. This issue is fixed in version 1.1.35.
Articles & Coverage 1
AnalysisAI
TLS certificate validation is disabled by default in @graphql-tools/executor-legacy-ws prior to 1.1.35, where buildWSLegacyExecutor() hardcoded rejectUnauthorized: false, so Node.js applications using that executor directly or url-loader configured with SubscriptionProtocol.LEGACY_WS will blindly accept any certificate presented over wss://. An unauthenticated attacker who already holds a man-in-the-middle position on the network path can impersonate the GraphQL subscription endpoint, disclose authentication material carried in connectionParams or headers, and modify subscription data; the assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, with the MITM prerequisite driving the High attack complexity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires ALL of the following: (1) the application runs on Node.js (browser WebSocket clients are explicitly unaffected because browsers enforce certificate validation); (2) the app uses buildWSLegacyExecutor() directly OR url-loader configured with SubscriptionProtocol.LEGACY_WS - the default/modern graphql-ws path is not implicated; (3) connections use wss:// (TLS); and (4) the attacker holds an active man-in-the-middle position on the network path to intercept the connection and present a forged certificate. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a legitimate but conditional risk, not a drive-by critical. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the vendor-released patch @graphql-tools/executor-legacy-ws 1.1.35 (and the corresponding @graphql-tools/url-loader patch from the same changeset), which flips the default to rejectUnauthorized: true and only permits an explicit opt-out; details are in GHSA-6fw5-9hq8-w87g (https://github.com/ardatan/graphql-tools/security/advisories/GHSA-6fw5-9hq8-w87g), PR https://github.com/ardatan/graphql-tools/pull/8426, commit https://github.com/ardatan/graphql-tools/commit/3831a0661514c91d99971052f983552556880402, and release https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/executor-legacy-ws@1.1.35. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Node.js application and transitive dependency that pulls in @graphql-tools/executor-legacy-ws, and flag any call path invoking buildWSLegacyExecutor() or url-loader configured with SubscriptionProtocol.LEGACY_WS; for those paths, immediately pass an explicit https.Agent with rejectUnauthorized: true (or an equivalent CA-verifying agent) into the executor and url-loader configuration so the hardcoded false default is overridden, and constrain outbound wss:// traffic to approved endpoint addresses and ports. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today