@graphql-tools/executor-legacy-ws CVE-2026-118666 (GHSA-mp66-8ww2-pcwm): subscription results delivered to the wrong caller when the legacy WebSocket executor is shared. Which version fixes it?

What it is: buildWSLegacyExecutor in @graphql-tools/executor-legacy-ws (used for GraphQL subscriptions over the old subscriptions-transport-ws protocol, for example in GraphQL Mesh or schema-stitching gateways) reuses one open WebSocket for several subscriptions. Each new subscription replaced the socket's single message handler, and data frames were delivered without checking which operation they belonged to. When one executor serves several callers, one caller's subscription results can be delivered to another caller, which leaks data between users or tenants. Published October 28, 2026 (rated medium by GitHub). Am I affected: - @graphql-tools/executor-legacy-ws 1.1.35 or earlier (the advisory notes the originally recorded range '<= 1.1.33' understated it). - Highest risk: a gateway or server that shares one legacy WS executor across requests from different users. - Check with npm ls @graphql-tools/executor-legacy-ws (it is often a transitive dependency). Fix: 1. Upgrade to @graphql-tools/executor-legacy-ws 1.1.36 or later (npm update, or add an override/resolution if a parent package pins an older version), then redeploy. 2. Longer term, move off the deprecated subscriptions-transport-ws protocol to graphql-ws (the graphql-transport-ws protocol), which tracks each operation by id. 3. Until upgraded, avoid sharing one legacy executor between different users' subscriptions; create one per connection or per user. Verify: npm ls shows 1.1.36+ everywhere in the tree; with two test users subscribed at the same time, each receives only its own events. Sources: https://github.com/ardatan/graphql-tools/security/advisories/GHSA-mp66-8ww2-pcwm https://github.com/advisories/GHSA-mp66-8ww2-pcwm https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/executor-legacy-ws@1.1.36