High, CVSS 8.7npmAmendedPublished
GraphQL Modules has a Race Condition issue
CVE-2026-23735 · GHSA-53wg-r69p-v3r7
- Affected
- npm graphql-modules >= 2.2.1, < 2.4.1; >= 3.0.0, < 3.1.1
- Fixed in
- 2.4.13.1.1· Vendor fix available
- Issue
- Originally reported as an issue #2613 but should be elevated to a security issue as the ExecutionContext is often used to pass authentication tokens from incoming requests to services loading data from backend APIs. Details When 2 or more parallel requests are made which trigger the same service, the context of the requests is mixed up in the service when the context is injected via @ExecutionContext() PoC In a new project/folder, create and install the following package.json: with: configure babel.config.json using: then write the following test GHSA-53wg-r69p-v3r7.spec.ts: and execute using: Your project tree should look like this: Expected vs. Actual Outcome Impact Any application that uses services that inject the context using @ExecutionContext() from a singleton provider are at risk. The more traffic an application has, the higher the chance for parallel requests, the higher the risk.
Recommended action: Upgrade to 3.1.1 or 2.4.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.