---
id: CVE-2026-103921
title: >-
  GraphQL Tools provides utilities for building, stitching, and mocking GraphQL
  schemas
summary: >-
  GraphQL Tools provides utilities for building, stitching, and mocking GraphQL
  schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor()
  function hardcodes TLS certificate rejection off for Node.js connections to
  wss:// end…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-295
vendor: ardatan
product: graphql-tools
affected:
  - graphql-tools < 1.1.35
  - executor-legacy-ws < 1.1.35
published: '2026-10-01'
updated: '2026-10-02'
sourceUpdated: '2026-10-02T18:44:45.660'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-103921'
references:
  - url: >-
      https://github.com/ardatan/graphql-tools/commit/3831a0661514c91d99971052f983552556880402
    label: security-advisories@github.com
  - url: 'https://github.com/ardatan/graphql-tools/pull/8426'
    label: security-advisories@github.com
  - url: >-
      https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/executor-legacy-ws@1.1.35
    label: security-advisories@github.com
  - url: >-
      https://github.com/ardatan/graphql-tools/security/advisories/GHSA-6fw5-9hq8-w87g
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-103921'
  - url: 'https://github.com/advisories/GHSA-6fw5-9hq8-w87g'
tags:
  - nvd
  - cve.org
  - ghsa
  - npm
epss: 0.00274
epssPercentile: 0.19853
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-01T18:04:13.318417Z'
ingestedAt: '2026-10-01T18:55:42.358Z'
aliases:
  - GHSA-6fw5-9hq8-w87g
ecosystem: npm
patched:
  - '@graphql-tools/executor-legacy-ws 1.1.35'
---

## Overview

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loader with SubscriptionProtocol.LEGACY_WS, can therefore accept an attacker-controlled certificate when a network-positioned attacker intercepts the connection. Authentication material in connectionParams or headers can be disclosed, and subscription data can be modified. Browser WebSocket clients are unaffected because browsers enforce certificate validation. This issue is fixed in version 1.1.35.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-103921)

Affected packages:

- `@graphql-tools/executor-legacy-ws <= 1.1.34`

Patched in:

- `@graphql-tools/executor-legacy-ws 1.1.35`

Source: https://github.com/advisories/GHSA-6fw5-9hq8-w87g