GHSA-6fw5-9hq8-w87g: High severity npm/@graphql-tools/executor-legacy-ws vulnerability
Impact
buildWSLegacyExecutor() in @graphql-tools/executor-legacy-ws previously hardcoded rejectUnauthorized: false when creating WebSocket connections over WSS. This disabled TLS certificate validation, allowing a network-positioned attacker to perform a Man-in-the-Middle (MITM) attack against applications that use this executor with a wss:// endpoint. Credentials passed via connectionParams or headers could be intercepted, and subscription data could be tampered with.
Who is impacted: Applications using @graphql-tools/executor-legacy-ws (directly or via @graphql-tools/url-loader with SubscriptionProtocol.LEGACYWS) to connect to a wss:// endpoint from Node.js while sending authentication material over the connection.
Browser WebSocket clients are unaffected by this option (browsers always validate certificates).
Patches
Upgrade to @graphql-tools/executor-legacy-ws@1.1.35 or later (and @graphql-tools/url-loader@9.1.9 or later if you use the loader). TLS certificate validation is enabled by default. Callers that intentionally use self-signed certificates in trusted environments can opt out with rejectUnauthorized: false.
Workarounds
- Prefer the modern graphql-ws / SubscriptionProtocol.WS path where possible. - Until upgraded, avoid sending secrets over legacy WSS connections, or terminate TLS at a trusted proxy and use ws:// only on trusted networks. - Supply a custom webSocketImpl that enforces certificate validation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@graphql-tools/executor-legacy-wsto a version that resolves this vulnerability.Fixed in 1.1.35 - Upgrade
Upgrade
@graphql-tools/executor-legacy-wsto a version that resolves this vulnerability.Fixed in 1.1.35 - Upgrade
Upgrade
@graphql-tools/url-loaderto a version that resolves this vulnerability.Fixed in 9.1.9 - Configuration
Prefer the modern graphql-ws path by using SubscriptionProtocol.WS instead of SubscriptionProtocol.LEGACY_WS where possible
GraphQL subscription client SubscriptionProtocol = WS - Configuration
Supply a custom webSocketImpl that enforces TLS certificate validation
@graphql-tools/executor-legacy-ws webSocketImpl - Compensating control
Until upgraded, avoid sending secrets over legacy WSS connections, or terminate TLS at a trusted proxy and use ws:// only on trusted networks
Event History
Frequently Asked Questions
Which deployments are exposed?
Affected deployments are Node.js applications using @graphql-tools/executor-legacy-ws directly, or through @graphql-tools/url-loader with SubscriptionProtocol.LEGACY_WS, to connect to a wss:// endpoint while sending authentication material. Browser WebSocket clients are unaffected because browsers validate certificates.
What must an attacker be able to do, and what could they obtain or change?
An attacker must be positioned on the network path to perform a man-in-the-middle attack against the WSS connection. They could intercept credentials sent through connectionParams or headers and tamper with subscription data.
Does a normal configuration validate WSS certificates?
Previously, buildWSLegacyExecutor() hardcoded rejectUnauthorized: false, disabling TLS certificate validation for its WSS connections. In @graphql-tools/executor-legacy-ws 1.1.35 and later, certificate validation is enabled by default.
What versions should be deployed to remediate this issue?
Upgrade @graphql-tools/executor-legacy-ws to version 1.1.35 or later. If using @graphql-tools/url-loader, upgrade it to version 9.1.9 or later.
Can an application continue using a self-signed certificate?
Callers using self-signed certificates in trusted environments can explicitly set rejectUnauthorized: false. Doing so opts out of certificate validation.