Race Condition Vulnerability in GraphQL Modules: High Risk for Context Injection
Summary
GHSA-53wg-r69p-v3r7: GraphQL Modules has a Race Condition issue. Affects graphql-modules across 2 version ranges.
>= 2.2.1, < 2.4.1
>= 3.0.0, < 3.1.1
Fixed in 2.4.1 or 3.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GraphQL Modules is a powerful library for building modular GraphQL applications. It allows developers to create reusable modules that encapsulate their GraphQL schema, resolvers, and services. The library is designed to enhance the organization and scalability of GraphQL applications. However, a recently identified race condition vulnerability poses a significant risk, particularly in scenarios where multiple requests are processed in parallel, leading to potential context mixing and unauthorized access to sensitive data.
Vulnerability Detail
The vulnerability arises from a race condition when two or more parallel requests trigger the same service, causing the execution context to be mixed up. This occurs when the context is injected via the @ExecutionContext() decorator, which is often used to pass authentication tokens from incoming requests to backend services. As a result, an attacker could exploit this flaw to access sensitive information intended for other users, especially in high-traffic applications where parallel requests are common.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.2.1, < 2.4.12.4.1npm install graphql-modules@2.4.1 -
>= 3.0.0, < 3.1.13.1.1npm install graphql-modules@3.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using the @ExecutionContext() decorator for injecting context in singleton services. Instead, consider passing the context explicitly as a parameter to the methods that require it, thereby preventing context mixing during parallel executions.
Conclusion
The race condition vulnerability in GraphQL Modules poses a significant risk to applications that utilize this library, especially under high traffic conditions. It is crucial to update to the latest patched versions to mitigate the risk and ensure the security of sensitive user data.
See every vulnerability recorded for graphql-modules →
FAQ
A race condition occurs when two or more processes or threads access shared data and try to change it at the same time. This can lead to unpredictable behavior and data corruption.
If your application uses GraphQL Modules and handles multiple requests simultaneously, this vulnerability could allow unauthorized access to sensitive data due to mixed execution contexts.
Failing to address this vulnerability could lead to data leaks, unauthorized access to user information, and potential breaches of user privacy, especially in applications with high traffic.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. It analyzes your package-lock.json file to identify potential risks.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
