CVE-2026-103921

Published 1 October 2026 · tracked since 2 October 2026

Description

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loader

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-101888 HIGH 7.2
• CVE-2026-101889 MEDIUM 6.5
• CVE-2026-101890 MEDIUM 5.4
• CVE-2026-94620
• CVE-2026-46729 HIGH 7.5
• CVE-2026-47360 HIGH 7.5
• CVE-2026-42356 LOW 3.7
• CVE-2026-42528 MEDIUM 4.3
• CVE-2026-103690 MEDIUM 6.3
• CVE-2026-97284 HIGH 8.8

→ Open the live CVE board · all tools