Skip to main content
cve.nowby Sazabi
← npm
npmPackage

graphql-modules

1 known vulnerability (1 high), with the versions each affects and the releases that fix them.

Latest release
3.1.2 (May 26, 2026): no advisory affects it
Newest unaffected release
3.1.2 (May 26, 2026), the latest release
Advisories
1 · 1 high
Weekly downloads
98.1K
Dependents
6
Releases
500+ since 2.1.1 (Mar 16, 2023)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-23735
    Affects 2.2.1 to 2.4.1-alpha-20260116150348-525dd2ddd1e3c121df8e2299fb9f874210b6e149 (2.4.1 is outside it); 3.0.0 to 3.1.0 (3.1.1 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 1

  • Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in graphql-modules

    Affected: from 2.2.1, fixed in 2.4.1; from 3.0.0, fixed in 3.1.1.

    Fixed in 2.4.1 (released Jan 16, 2026, the day of disclosure) and 3.1.1 (released Jan 16, 2026, the day of disclosure).

    The latest release, 3.1.2, is not affected.

    17% of graphql-modules downloads last week were affected versions (18.2K).