{"id":"CVE-2026-103921","aliases":["GHSA-6fw5-9hq8-w87g"],"url":"https://o3.security/vulnerability/CVE-2026-103921","summary":"GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor","details":"## Impact\n\n`buildWSLegacyExecutor()` in `@graphql-tools/executor-legacy-ws` previously hardcoded `rejectUnauthorized: false` when creating WebSocket connections over WSS. This disabled TLS certificate validation, allowing a network-positioned attacker to perform a Man-in-the-Middle (MITM) attack against applications that use this executor with a `wss://` endpoint. Credentials passed via `connectionParams` or `headers` could be intercepted, and subscription data could be tampered with.\n\n**Who is impacted:** Applications using `@graphql-tools/executor-legacy-ws` (directly or via `@graphql-tools/url-loader` with `SubscriptionProtocol.LEGACY_WS`) to connect to a `wss://` endpoint from Node.js while sending authentication material over the connection.\n\nBrowser WebSocket clients are unaffected by this option (browsers always validate certificates).\n\n## Patches\n\nUpgrade to `@graphql-tools/executor-legacy-ws@1.1.35` or later (and `@graphql-tools/url-loader@9.1.9` or later if you use the loader). TLS certificate validation is enabled by default. Callers that intentionally use self-signed certificates in trusted environments can opt out with `rejectUnauthorized: false`.\n\n## Workarounds\n\n- Prefer the modern `graphql-ws` / `SubscriptionProtocol.WS` path where possible.\n- Until upgraded, avoid sending secrets over legacy WSS connections, or terminate TLS at a trusted proxy and use `ws://` only on trusted networks.\n- Supply a custom `webSocketImpl` that enforces certificate validation.","published":"2026-10-01T16:32:37.865Z","modified":"2026-10-21T02:54:31.798647434Z","cvss":{"score":7.4,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"@graphql-tools/executor-legacy-ws","fixedVersion":"1.1.35"}],"fix":{"url":"https://github.com/ardatan/graphql-tools/commit/3831a0661514c91d99971052f983552556880402","label":"ardatan/graphql-tools@3831a06"},"references":[{"type":"WEB","url":"https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/executor-legacy-ws@1.1.35"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103921.json"},{"type":"ADVISORY","url":"https://github.com/ardatan/graphql-tools/security/advisories/GHSA-6fw5-9hq8-w87g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103921"},{"type":"FIX","url":"https://github.com/ardatan/graphql-tools/commit/3831a0661514c91d99971052f983552556880402"},{"type":"FIX","url":"https://github.com/ardatan/graphql-tools/pull/8426"},{"type":"PACKAGE","url":"https://github.com/ardatan/graphql-tools"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:54:31.798647434Z"}}