GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
Impact
buildWSLegacyExecutor() in @graphql-tools/executor-legacy-ws previously hardcoded rejectUnauthorized: false when creating WebSocket connections over WSS. This disabled TLS certificate validation, allowing a network-positioned attacker to perform a Man-in-the-Middle (MITM) attack against applications that use this executor with a wss:// endpoint. Credentials passed via connectionParams or headers could be intercepted, and subscription data could be tampered with.
Who is impacted: Applications using @graphql-tools/executor-legacy-ws (directly or via @graphql-tools/url-loader with SubscriptionProtocol.LEGACY_WS) to connect to a wss:// endpoint from Node.js while sending authentication material over the connection.
Browser WebSocket clients are unaffected by this option (browsers always validate certificates).
Patches
Upgrade to @graphql-tools/executor-legacy-ws@1.1.35 or later (and @graphql-tools/url-loader@9.1.9 or later if you use the loader). TLS certificate validation is enabled by default. Callers that intentionally use self-signed certificates in trusted environments can opt out with rejectUnauthorized: false.
Workarounds
- Prefer the modern
graphql-ws/SubscriptionProtocol.WSpath where possible. - Until upgraded, avoid sending secrets over legacy WSS connections, or terminate TLS at a trusted proxy and use
ws://only on trusted networks. - Supply a custom
webSocketImplthat enforces certificate validation.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @graphql-tools/executor-legacy-ws | < 1.1.35 | 1.1.35 |
References
- https://github.com/ardatan/graphql-tools/security/advisories/GHSA-6fw5-9hq8-w87g
- https://nvd.nist.gov/vuln/detail/CVE-2026-103921
- https://github.com/ardatan/graphql-tools/pull/8426
- https://github.com/ardatan/graphql-tools/commit/3831a0661514c91d99971052f983552556880402
- https://github.com/ardatan/graphql-tools
- https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/executor-legacy-ws@1.1.35
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N- Weakness (CWE)
CWE-295- Platform
- npm
- Package
@graphql-tools/executor-legacy-ws- Disclosed
- 05.10.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-6fw5-9hq8-w87g - CC BY 4.0
Vulnerability history: @graphql-tools/executor-legacy-ws
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.