Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@envelop/graphql-modules

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7npmAmendedPublished

    @envelop/graphql-modules has a Race Condition vulnerability

    GHSA-h3hw-29fv-2x75

    Affected
    • npm @envelop/graphql-modules < 9.1.0
    Fixed in
    9.1.0· Vendor fix available
    Issue
    Context race condition when using useGraphQLModules plugin Details Related to: https://github.com/graphql-hive/graphql-modules/security/advisories/GHSA-53wg-r69p-v3r7 When 2 or more parallel requests are made which trigger the same service, the context of the requests is mixed up in the service when the context is injected via @ExecutionContext() and graphql-modules are used in Yoga with useGraphQLModules(application). This issue was fixed in graphql-modules in 2.4.1 and 3.1.1 but using useGraphQLModules will bypass the asynchooks fix that was implemented. PoC Create the following package.json and run npm i Define the app entrypoint: src/index.ts Create the test module: src/module.ts Add the Service that's to be injected src/service.ts Add the test case test/bleedtest.js Then run the server with npm run start in one terminal and the testcase in another with npm run test. The returned IDs should be identical as they are both read from the context within the same request.…

    Recommended action: Upgrade to 9.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →