Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@graphql-tools/executor-legacy-ws

3 known vulnerabilities (2 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
2.0.8 (Oct 31, 2026): no advisory affects it
Newest unaffected release
2.0.8 (Oct 31, 2026), the latest release
Advisories
3 · 2 high, 1 medium
Weekly downloads
11.5M
Dependents
10
Releases
500+ since 1.1.20 (Oct 30, 2025)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-118666
    Affects 1.1.20-alpha-20251021211525-f24987f6bc376d6c6e88fdb1cfcc89beaef4ef5c to 1.1.36-alpha-20260930213106-001ad6da4923b8bb612d81d5418e51f7365e603b (1.1.36 is outside it)
  • CVE-2026-118665
    Affects 1.1.20-alpha-20251021211525-f24987f6bc376d6c6e88fdb1cfcc89beaef4ef5c to 1.1.36-alpha-20260930213106-001ad6da4923b8bb612d81d5418e51f7365e603b (1.1.36 is outside it)
  • CVE-2026-103921
    Affects 1.1.20-alpha-20251021211525-f24987f6bc376d6c6e88fdb1cfcc89beaef4ef5c to 1.1.35-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a (1.1.35 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 3

  • CVE-2026-118666Medium 6.0

    GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

    Affected: fixed in 1.1.36.

    Fixed in 1.1.36 (released Sep 30, 2026, 28 days before disclosure).

    The latest release, 2.0.8, is not affected.

    69% of @graphql-tools/executor-legacy-ws downloads last week were affected versions (9.1M).

  • GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications

    Affected: fixed in 1.1.36.

    Fixed in 1.1.36 (released Sep 30, 2026, 28 days before disclosure).

    The latest release, 2.0.8, is not affected.

    69% of @graphql-tools/executor-legacy-ws downloads last week were affected versions (9.1M).

  • GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

    Affected: fixed in 1.1.35.

    Fixed in 1.1.35 (released Sep 8, 2026, 23 days before disclosure).

    The latest release, 2.0.8, is not affected.

    64% of @graphql-tools/executor-legacy-ws downloads last week were affected versions (8.5M).