CVE-2026-103921: @graphql-tools/executor-legacy-ws - TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
Summary
CVE-2026-103921: GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor. Affects @graphql-tools/executor-legacy-ws versions < 1.1.35. Fixed in 1.1.35. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @graphql-tools/executor-legacy-ws package is a component of the GraphQL Tools library, which provides utilities for building GraphQL servers. It specifically facilitates the execution of GraphQL subscriptions over WebSocket connections. This package is designed to work with legacy WebSocket protocols, allowing developers to implement real-time features in their applications. However, it has a significant vulnerability related to TLS certificate validation, which can expose applications to security risks.
Vulnerability Detail
The vulnerability arises from the method buildWSLegacyExecutor() in the @graphql-tools/executor-legacy-ws package, which previously set rejectUnauthorized to false when establishing WebSocket connections over WSS. This configuration disables TLS certificate validation, making it possible for a network-positioned attacker to execute a Man-in-the-Middle (MITM) attack. Such an attack could lead to the interception of credentials sent via connectionParams or headers, as well as the tampering of subscription data. Applications that use this executor to connect to a wss:// endpoint from Node.js while transmitting sensitive information are particularly at risk.
How To Fix
Latest published version: 2.0.6 as of 23 Oct 2026
npm install @graphql-tools/executor-legacy-ws@2.0.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.35
This is the first release that contains the fix.
npm install @graphql-tools/executor-legacy-ws@1.1.35Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot upgrade immediately, consider the following workarounds:
- Prefer using the modern graphql-ws / SubscriptionProtocol.WS path where possible.
- Until you can upgrade, avoid sending sensitive information over legacy WSS connections. Alternatively, terminate TLS at a trusted proxy and use ws:// only on trusted networks.
- Supply a custom webSocketImpl that enforces certificate validation.
Conclusion
The vulnerability CVE-2026-103921 in the @graphql-tools/executor-legacy-ws package poses a significant security risk due to disabled TLS certificate validation. It is crucial for developers to upgrade to the patched version or implement workarounds to protect sensitive data from potential interception and tampering.
See every vulnerability recorded for @graphql-tools/executor-legacy-ws →
FAQ
The CVSS score of this vulnerability is 7.4, indicating a high severity level.
Applications using @graphql-tools/executor-legacy-ws to connect to a wss:// endpoint from Node.js while sending authentication material are affected.
No, browser WebSocket clients are not affected as they always validate certificates.
You can implement workarounds such as avoiding sending secrets over legacy WSS connections or using a trusted proxy.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
