CVE-2026-118666

Name of the Vulnerable Software and Affected Versions @graphql-tools/executor-legacy-ws versions prior to 1.1.36

Description In the buildWSLegacyExecutor function, the software reuses a single WebSocket and replaces its websocket.onmessage handler whenever a new overlapping subscription starts. The handler delivers LEGACY WS.DATA frames to the most recent observer without verifying if the data.id matches the subscription operation id. Consequently, a user sharing the same executor can receive another user's authorized subscription payload, while the original user's stream is starved. This results in a cross-tenant data leak where private GraphQL subscription payloads are disclosed to unauthorized callers.

Recommendations Update @graphql-tools/executor-legacy-ws to version 1.1.36 or later. As a temporary workaround, avoid reusing a single executor instance across multiple callers and instead construct a new executor for each operation.