CVE-2026-118665Published
GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-118665 · Microsoft / collected KEV context
cve-program · CVE-2026-118665
- https://github.com/ardatan/graphql-tools/security/advisories/GHSA-434m-5hcj-pxf3
- https://github.com/ardatan/graphql-tools/pull/8480
- https://github.com/ardatan/graphql-tools/commit/c2f226e6f68236be9e4a577f29faeaa92547458b
- https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/[email protected]
euvd · EUVD-2026-112472
- https://github.com/ardatan/graphql-tools/security/advisories/GHSA-434m-5hcj-pxf3
- https://github.com/ardatan/graphql-tools/pull/8480
- https://github.com/ardatan/graphql-tools/commit/c2f226e6f68236be9e4a577f29faeaa92547458b
- https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/[email protected]
nvd · CVE-2026-118665
- https://github.com/ardatan/graphql-tools/commit/c2f226e6f68236be9e4a577f29faeaa92547458b
- https://github.com/ardatan/graphql-tools/pull/8480
- https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/[email protected]
- https://github.com/ardatan/graphql-tools/security/advisories/GHSA-434m-5hcj-pxf3
osv · GHSA-434m-5hcj-pxf3
- https://github.com/ardatan/graphql-tools/security/advisories/GHSA-434m-5hcj-pxf3
- https://github.com/ardatan/graphql-tools/pull/8480
- https://github.com/ardatan/graphql-tools/commit/c2f226e6f68236be9e4a577f29faeaa92547458b
- https://github.com/ardatan/graphql-tools
- https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/[email protected]
Related operational evidence
Explicit CVE identifiers- GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retain… · Advisory content revised · 30 Oct 2026
- GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retain… · Advisory content revised · 30 Oct 2026
- GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications · Newly collected advisory · 28 Oct 2026
- GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications · Newly collected advisory · 28 Oct 2026