CVE-2026-103921: GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
Impact
buildWSLegacyExecutor() in @graphql-tools/executor-legacy-ws previously hardcoded rejectUnauthorized: false when creating WebSocket connections over WSS. This disabled TLS certificate validation, allowing a network-positioned attacker to perform a Man-in-the-Middle (MITM) attack against applications that use this executor with a wss:// endpoint. Credentials passed via connectionParams or headers could be intercepted, and subscription data could be tampered with.
Who is impacted: Applications using @graphql-tools/executor-legacy-ws (directly or via @graphql-tools/url-loader with SubscriptionProtocol.LEGACYWS) to connect to a wss:// endpoint from Node.js while sending authentication material over the connection.
Browser WebSocket clients are unaffected by this option (browsers always validate certificates).
Patches
Upgrade to @graphql-tools/executor-legacy-ws@1.1.35 or later (and @graphql-tools/url-loader@9.1.9 or later if you use the loader). TLS certificate validation is enabled by default. Callers that intentionally use self-signed certificates in trusted environments can opt out with rejectUnauthorized: false.
Workarounds
- Prefer the modern graphql-ws / SubscriptionProtocol.WS path where possible. - Until upgraded, avoid sending secrets over legacy WSS connections, or terminate TLS at a trusted proxy and use ws:// only on trusted networks. - Supply a custom webSocketImpl that enforces certificate validation.
Other sources
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loader with SubscriptionProtocol.LEGACYWS, can therefore accept an attacker-controlled certificate when a network-positioned attacker intercepts the connection. Authentication material in connectionParams or headers can be disclosed, and subscription data can be modified. Browser WebSocket clients are unaffected because browsers enforce certificate validation. This issue is fixed in version 1.1.35.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@graphql-tools/executor-legacy-wsto a version that resolves this vulnerability.Fixed in 1.1.35 - Upgrade
Upgrade
@graphql-tools/executor-legacy-wsto a version that resolves this vulnerability.Fixed in 1.1.35 - Upgrade
Upgrade
@graphql-tools/url-loaderto a version that resolves this vulnerability.Fixed in 9.1.9 - Configuration
Prefer the modern graphql-ws path by using SubscriptionProtocol.WS instead of SubscriptionProtocol.LEGACY_WS where possible
GraphQL Tools WebSocket subscriptions SubscriptionProtocol = WS - Configuration
Supply a custom webSocketImpl that enforces TLS certificate validation
@graphql-tools/executor-legacy-ws webSocketImpl = certificate-validating WebSocket implementation - Compensating control
Until upgraded, avoid sending secrets over legacy WSS connections, or terminate TLS at a trusted proxy and use ws:// only on trusted networks
Event History
Frequently Asked Questions
Which deployments are exposed?
Node.js applications that use buildWSLegacyExecutor() directly or use url-loader with SubscriptionProtocol.LEGACY_WS to connect to wss:// endpoints are exposed before version 1.1.35. Browser-based WebSocket clients are unaffected because browsers enforce certificate validation.
What does an attacker need to exploit this?
An attacker must be in a network position to intercept the application's wss:// connection and present an attacker-controlled TLS certificate. No authentication or user interaction is required.
What is at risk if exploitation succeeds?
Authentication material supplied through connectionParams or headers can be disclosed. An attacker can also modify subscription data transmitted over the intercepted connection.
What should teams do if they cannot patch immediately?
The provided data identifies the affected legacy executor and protocol mode, but does not specify a workaround. Prioritize removing or avoiding executor-legacy-ws and SubscriptionProtocol.LEGACY_WS usage for Node.js wss:// connections until upgrading to version 1.1.35 or later.