CVE-2026-118665

Name of the Vulnerable Software and Affected Versions @graphql-tools/executor-legacy-ws versions prior to 1.1.36

Description In the buildWSLegacyExecutor function within packages/executors/legacy-ws/src/index.ts, the executorConnectionParams object is retained in the closure scope after a connection is closed via cleanupWebsocket. When a single executor is reused across different authorization contexts, a subsequent request that omits sensitive keys will reuse the Authorization or tenant values from a previous caller in its connection init payload. This allows a later caller to be authenticated as a previous user by the downstream server. This issue specifically affects applications that share a single executor instance across multiple requests; applications that create a new executor for every request are not affected.

Recommendations Update @graphql-tools/executor-legacy-ws to version 1.1.36 or later. As a temporary workaround, avoid reusing the same executor instance across different users or authorization contexts, and instead create a new executor for every request.