CVSS 4.0
8.7 highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NCVE-2026-23735
High (8.7). EPSS 0.6% chance of exploitation in the next 30 days. Fixed in graphql-modules 2.4.1, 3.1.1.
GraphQL Modules is a toolset of libraries and guidelines dedicated to create reusable, maintainable, testable and extendable modules out of your GraphQL server. From 2.2.1 to before 2.4.1 and 3.1.1, when 2 or more parallel requests are made which trigger the same service, the context of the requests is mixed up in the service when the context is injected via @ExecutionContext(). ExecutionContext is often used to pass authentication tokens from incoming requests to services loading data from backend APIs. This vulnerability is fixed in 2.4.1 and 3.1.1.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
- CWE
- CWE-362
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-53wg-r69p-v3r7 | npm | graphql-modules | >=2.2.1 <2.4.1 | 2.4.1 |
| GHSA-53wg-r69p-v3r7 | npm | graphql-modules | >=3.0.0 <3.1.1 | 3.1.1 |