Vulnerability-Lookup

CVE-2026-23735 (GCVE-0-2026-23735)

Vulnerability from cvelistv5 – Published: 2026-01-16 20:04 – Updated: 2026-01-16 20:28

Title

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in graphql-modules

Summary

GraphQL Modules is a toolset of libraries and guidelines dedicated to create reusable, maintainable, testable and extendable modules out of your GraphQL server. From 2.2.1 to before 2.4.1 and 3.1.1, when 2 or more parallel requests are made which trigger the same service, the context of the requests is mixed up in the service when the context is injected via @ExecutionContext(). ExecutionContext is often used to pass authentication tokens from incoming requests to services loading data from backend APIs. This vulnerability is fixed in 2.4.1 and 3.1.1.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-16 20:27 UTC

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/graphql-hive/graphql-modules/s…	x_refsource_CONFIRM
https://github.com/graphql-hive/graphql-modules/i…	x_refsource_MISC
https://github.com/graphql-hive/graphql-modules/p…	x_refsource_MISC
https://github.com/graphql-hive/graphql-modules/r…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
graphql-hive	graphql-modules	Affected: >= 2.2.1, < 2.4.1 Affected: >= 3.0.0, < 3.1.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23735",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-16T20:27:47.456616Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-16T20:28:19.571Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "graphql-modules",
          "vendor": "graphql-hive",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.2.1, \u003c 2.4.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.1.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GraphQL Modules is a toolset of libraries and guidelines dedicated to create reusable, maintainable, testable and extendable modules out of your GraphQL server. From 2.2.1 to before 2.4.1 and 3.1.1, when 2 or more parallel requests are made which trigger the same service, the context of the requests is mixed up in the service when the context is injected via @ExecutionContext(). ExecutionContext is often used to pass authentication tokens from incoming requests to services loading data from backend APIs. This vulnerability is fixed in 2.4.1 and 3.1.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-16T20:04:19.672Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/graphql-hive/graphql-modules/security/advisories/GHSA-53wg-r69p-v3r7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/graphql-hive/graphql-modules/security/advisories/GHSA-53wg-r69p-v3r7"
        },
        {
          "name": "https://github.com/graphql-hive/graphql-modules/issues/2613",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-hive/graphql-modules/issues/2613"
        },
        {
          "name": "https://github.com/graphql-hive/graphql-modules/pull/2521",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-hive/graphql-modules/pull/2521"
        },
        {
          "name": "https://github.com/graphql-hive/graphql-modules/releases/tag/release-1768575025568",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-hive/graphql-modules/releases/tag/release-1768575025568"
        }
      ],
      "source": {
        "advisory": "GHSA-53wg-r69p-v3r7",
        "discovery": "UNKNOWN"
      },
      "title": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027) in graphql-modules"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-23735",
    "datePublished": "2026-01-16T20:04:19.672Z",
    "dateReserved": "2026-01-15T15:45:01.957Z",
    "dateUpdated": "2026-01-16T20:28:19.571Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23735",
      "date": "2026-09-24",
      "epss": "0.00568",
      "percentile": "0.44671"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "graphql-modules",
                "vendor": "graphql-hive",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 2.2.1, \u003c 2.4.1"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 3.0.0, \u003c 3.1.1"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "GraphQL Modules is a toolset of libraries and guidelines dedicated to create reusable, maintainable, testable and extendable modules out of your GraphQL server. From 2.2.1 to before 2.4.1 and 3.1.1, when 2 or more parallel requests are made which trigger the same service, the context of the requests is mixed up in the service when the context is injected via @ExecutionContext(). ExecutionContext is often used to pass authentication tokens from incoming requests to services loading data from backend APIs. This vulnerability is fixed in 2.4.1 and 3.1.1."
          },
          {
            "lang": "es",
            "value": "GraphQL Modules es un conjunto de herramientas de bibliotecas y directrices dedicado a crear m\u00f3dulos reutilizables, mantenibles, testeables y extensibles a partir de tu servidor GraphQL. Desde la versi\u00f3n 2.2.1 hasta antes de la 2.4.1 y la 3.1.1, cuando se realizan 2 o m\u00e1s solicitudes paralelas que activan el mismo servicio, el contexto de las solicitudes se mezcla en el servicio cuando el contexto se inyecta a trav\u00e9s de @ExecutionContext(). ExecutionContext se utiliza a menudo para pasar tokens de autenticaci\u00f3n de solicitudes entrantes a servicios que cargan datos de APIs de backend. Esta vulnerabilidad se corrige en las versiones 2.4.1 y 3.1.1."
          }
        ],
        "id": "CVE-2026-23735",
        "lastModified": "2026-06-17T10:22:01.127",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-23735",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-16T20:27:47.456616Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-01-16T20:15:51.473",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/graphql-hive/graphql-modules/issues/2613"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/graphql-hive/graphql-modules/pull/2521"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/graphql-hive/graphql-modules/releases/tag/release-1768575025568"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/graphql-hive/graphql-modules/security/advisories/GHSA-53wg-r69p-v3r7"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-362"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-01-19T12:27:17+00:00",
      "cve": "CVE-2026-23735",
      "id": "CVE-2026-23735",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027) in graphql-modules",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23735.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-23735",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-01-16T20:27:47.456616Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-01-16T20:28:11.535Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "graphql-modules",
              "vendor": "graphql-hive",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 2.2.1, \u003c 2.4.1"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 3.0.0, \u003c 3.1.1"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "GraphQL Modules is a toolset of libraries and guidelines dedicated to create reusable, maintainable, testable and extendable modules out of your GraphQL server. From 2.2.1 to before 2.4.1 and 3.1.1, when 2 or more parallel requests are made which trigger the same service, the context of the requests is mixed up in the service when the context is injected via @ExecutionContext(). ExecutionContext is often used to pass authentication tokens from incoming requests to services loading data from backend APIs. This vulnerability is fixed in 2.4.1 and 3.1.1."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "HIGH"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-362",
                  "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-01-16T20:04:19.672Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/graphql-hive/graphql-modules/security/advisories/GHSA-53wg-r69p-v3r7",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/graphql-hive/graphql-modules/security/advisories/GHSA-53wg-r69p-v3r7"
            },
            {
              "name": "https://github.com/graphql-hive/graphql-modules/issues/2613",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/graphql-hive/graphql-modules/issues/2613"
            },
            {
              "name": "https://github.com/graphql-hive/graphql-modules/pull/2521",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/graphql-hive/graphql-modules/pull/2521"
            },
            {
              "name": "https://github.com/graphql-hive/graphql-modules/releases/tag/release-1768575025568",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/graphql-hive/graphql-modules/releases/tag/release-1768575025568"
            }
          ],
          "source": {
            "advisory": "GHSA-53wg-r69p-v3r7",
            "discovery": "UNKNOWN"
          },
          "title": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027) in graphql-modules"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-23735",
        "datePublished": "2026-01-16T20:04:19.672Z",
        "dateReserved": "2026-01-15T15:45:01.957Z",
        "dateUpdated": "2026-01-16T20:28:19.571Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-23735

Vulnerability from fkie_nvd - Published: 2026-01-16 20:15 - Updated: 2026-06-17 10:22

Severity

8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/graphql-hive/graphql-modules/issues/2613
	security-advisories@github.com	https://github.com/graphql-hive/graphql-modules/pull/2521
	security-advisories@github.com	https://github.com/graphql-hive/graphql-modules/releases/tag/release-1768575025568
	security-advisories@github.com	https://github.com/graphql-hive/graphql-modules/security/advisories/GHSA-53wg-r69p-v3r7

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "graphql-modules",
          "vendor": "graphql-hive",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.2.1, \u003c 2.4.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.1.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "GraphQL Modules is a toolset of libraries and guidelines dedicated to create reusable, maintainable, testable and extendable modules out of your GraphQL server. From 2.2.1 to before 2.4.1 and 3.1.1, when 2 or more parallel requests are made which trigger the same service, the context of the requests is mixed up in the service when the context is injected via @ExecutionContext(). ExecutionContext is often used to pass authentication tokens from incoming requests to services loading data from backend APIs. This vulnerability is fixed in 2.4.1 and 3.1.1."
    },
    {
      "lang": "es",
      "value": "GraphQL Modules es un conjunto de herramientas de bibliotecas y directrices dedicado a crear m\u00f3dulos reutilizables, mantenibles, testeables y extensibles a partir de tu servidor GraphQL. Desde la versi\u00f3n 2.2.1 hasta antes de la 2.4.1 y la 3.1.1, cuando se realizan 2 o m\u00e1s solicitudes paralelas que activan el mismo servicio, el contexto de las solicitudes se mezcla en el servicio cuando el contexto se inyecta a trav\u00e9s de @ExecutionContext(). ExecutionContext se utiliza a menudo para pasar tokens de autenticaci\u00f3n de solicitudes entrantes a servicios que cargan datos de APIs de backend. Esta vulnerabilidad se corrige en las versiones 2.4.1 y 3.1.1."
    }
  ],
  "id": "CVE-2026-23735",
  "lastModified": "2026-06-17T10:22:01.127",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-23735",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-01-16T20:27:47.456616Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-01-16T20:15:51.473",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/graphql-hive/graphql-modules/issues/2613"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/graphql-hive/graphql-modules/pull/2521"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/graphql-hive/graphql-modules/releases/tag/release-1768575025568"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/graphql-hive/graphql-modules/security/advisories/GHSA-53wg-r69p-v3r7"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-53WG-R69P-V3R7

Vulnerability from github – Published: 2026-01-16 21:09 – Updated: 2026-01-21 16:20

Summary

GraphQL Modules has a Race Condition issue

Details

Summary

Originally reported as an issue #2613 but should be elevated to a security issue as the ExecutionContext is often used to pass authentication tokens from incoming requests to services loading data from backend APIs.

Details

When 2 or more parallel requests are made which trigger the same service, the context of the requests is mixed up in the service when the context is injected via @ExecutionContext()

PoC

In a new project/folder, create and install the following package.json:

{
  "name": "GHSA-53wg-r69p-v3r7",
  "scripts": {
    "test": "jest"
  },
  "dependencies": {
    "graphql-modules": "2.4.0"
  },
  "devDependencies": {
    "@babel/plugin-proposal-class-properties": "^7.18.6",
    "@babel/plugin-proposal-decorators": "^7.28.6",
    "babel-plugin-parameter-decorator": "^1.0.16",
    "jest": "^29.7.0",
    "reflect-metadata": "^0.2.2"
  }
}

with:

npm i

configure babel.config.json using:

{
  "plugins": [
    ["@babel/plugin-proposal-decorators", { "legacy": true }],
    "babel-plugin-parameter-decorator",
    "@babel/plugin-proposal-class-properties"
  ]
}

then write the following test GHSA-53wg-r69p-v3r7.spec.ts:

require("reflect-metadata");
const {
  createApplication,
  createModule,
  Injectable,
  Scope,
  ExecutionContext,
  gql,
  testkit,
} = require("graphql-modules");

test("accessing a singleton provider context during another asynchronous execution", async () => {
  @Injectable({ scope: Scope.Singleton })
  class IdentifierProvider {
    @ExecutionContext()
    context;

    getId() {
      return this.context.identifier;
    }
  }

  const { promise: gettingBefore, resolve: gotBefore } = createDeferred();

  const { promise: waitForGettingAfter, resolve: getAfter } = createDeferred();

  const mod = createModule({
    id: "mod",
    providers: [IdentifierProvider],
    typeDefs: gql`
      type Query {
        getAsyncIdentifiers: Identifiers!
      }

      type Identifiers {
        before: String!
        after: String!
      }
    `,
    resolvers: {
      Query: {
        async getAsyncIdentifiers(_0, _1, context) {
          const before = context.injector.get(IdentifierProvider).getId();
          gotBefore();
          await waitForGettingAfter;
          const after = context.injector.get(IdentifierProvider).getId();
          return { before, after };
        },
      },
    },
  });

  const app = createApplication({
    modules: [mod],
  });

  const document = gql`
    {
      getAsyncIdentifiers {
        before
        after
      }
    }
  `;

  const firstResult$ = testkit.execute(app, {
    contextValue: {
      identifier: "first",
    },
    document,
  });

  await gettingBefore;

  const secondResult$ = testkit.execute(app, {
    contextValue: {
      identifier: "second",
    },
    document,
  });

  getAfter();

  await expect(firstResult$).resolves.toEqual({
    data: {
      getAsyncIdentifiers: {
        before: "first",
        after: "first",
      },
    },
  });

  await expect(secondResult$).resolves.toEqual({
    data: {
      getAsyncIdentifiers: {
        before: "second",
        after: "second",
      },
    },
  });
});

function createDeferred() {
  let resolve, reject;
  const promise = new Promise((res, rej) => {
    resolve = res;
    reject = rej;
  });
  return {
    promise,
    resolve,
    reject,
  };
}

and execute using:

npm test

Your project tree should look like this:

GHSA-53wg-r69p-v3r7
    package.json
    package-lock.json
    babel.config.json
    GHSA-53wg-r69p-v3r7.spec.js

Expected vs. Actual Outcome

- Expected  - 1
+ Received  + 1

  Object {
    "data": Object {
      "getAsyncIdentifiers": Object {
-       "after": "first",
+       "after": "second",
        "before": "first",
      },
    },
  }

Impact

Any application that uses services that inject the context using @ExecutionContext() from a singleton provider are at risk. The more traffic an application has, the higher the chance for parallel requests, the higher the risk.

Severity

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "graphql-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.2.1"
            },
            {
              "fixed": "2.4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "graphql-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-23735"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-16T21:09:08Z",
    "nvd_published_at": "2026-01-16T20:15:51Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nOriginally reported as an issue #2613 but should be elevated to a security issue as the ExecutionContext is often used to pass authentication tokens from incoming requests to services loading data from backend APIs.\n\n### Details\nWhen 2 or more parallel requests are made which trigger the same service, the context of the requests is mixed up in the service when the context is injected via `@ExecutionContext()`\n\n### PoC\n\nIn a new project/folder, create and install the following `package.json`:\n\n```json\n{\n  \"name\": \"GHSA-53wg-r69p-v3r7\",\n  \"scripts\": {\n    \"test\": \"jest\"\n  },\n  \"dependencies\": {\n    \"graphql-modules\": \"2.4.0\"\n  },\n  \"devDependencies\": {\n    \"@babel/plugin-proposal-class-properties\": \"^7.18.6\",\n    \"@babel/plugin-proposal-decorators\": \"^7.28.6\",\n    \"babel-plugin-parameter-decorator\": \"^1.0.16\",\n    \"jest\": \"^29.7.0\",\n    \"reflect-metadata\": \"^0.2.2\"\n  }\n}\n```\n\nwith:\n\n```\nnpm i\n```\n\nconfigure `babel.config.json` using:\n\n```json\n{\n  \"plugins\": [\n    [\"@babel/plugin-proposal-decorators\", { \"legacy\": true }],\n    \"babel-plugin-parameter-decorator\",\n    \"@babel/plugin-proposal-class-properties\"\n  ]\n}\n```\n\nthen write the following test `GHSA-53wg-r69p-v3r7.spec.ts`:\n\n```js\nrequire(\"reflect-metadata\");\nconst {\n  createApplication,\n  createModule,\n  Injectable,\n  Scope,\n  ExecutionContext,\n  gql,\n  testkit,\n} = require(\"graphql-modules\");\n\ntest(\"accessing a singleton provider context during another asynchronous execution\", async () =\u003e {\n  @Injectable({ scope: Scope.Singleton })\n  class IdentifierProvider {\n    @ExecutionContext()\n    context;\n\n    getId() {\n      return this.context.identifier;\n    }\n  }\n\n  const { promise: gettingBefore, resolve: gotBefore } = createDeferred();\n\n  const { promise: waitForGettingAfter, resolve: getAfter } = createDeferred();\n\n  const mod = createModule({\n    id: \"mod\",\n    providers: [IdentifierProvider],\n    typeDefs: gql`\n      type Query {\n        getAsyncIdentifiers: Identifiers!\n      }\n\n      type Identifiers {\n        before: String!\n        after: String!\n      }\n    `,\n    resolvers: {\n      Query: {\n        async getAsyncIdentifiers(_0, _1, context) {\n          const before = context.injector.get(IdentifierProvider).getId();\n          gotBefore();\n          await waitForGettingAfter;\n          const after = context.injector.get(IdentifierProvider).getId();\n          return { before, after };\n        },\n      },\n    },\n  });\n\n  const app = createApplication({\n    modules: [mod],\n  });\n\n  const document = gql`\n    {\n      getAsyncIdentifiers {\n        before\n        after\n      }\n    }\n  `;\n\n  const firstResult$ = testkit.execute(app, {\n    contextValue: {\n      identifier: \"first\",\n    },\n    document,\n  });\n\n  await gettingBefore;\n\n  const secondResult$ = testkit.execute(app, {\n    contextValue: {\n      identifier: \"second\",\n    },\n    document,\n  });\n\n  getAfter();\n\n  await expect(firstResult$).resolves.toEqual({\n    data: {\n      getAsyncIdentifiers: {\n        before: \"first\",\n        after: \"first\",\n      },\n    },\n  });\n\n  await expect(secondResult$).resolves.toEqual({\n    data: {\n      getAsyncIdentifiers: {\n        before: \"second\",\n        after: \"second\",\n      },\n    },\n  });\n});\n\nfunction createDeferred() {\n  let resolve, reject;\n  const promise = new Promise((res, rej) =\u003e {\n    resolve = res;\n    reject = rej;\n  });\n  return {\n    promise,\n    resolve,\n    reject,\n  };\n}\n```\n\nand execute using:\n\n```\nnpm test\n```\n\nYour project tree should look like this:\n\n```\nGHSA-53wg-r69p-v3r7\n    package.json\n    package-lock.json\n    babel.config.json\n    GHSA-53wg-r69p-v3r7.spec.js\n```\n\n#### Expected vs. Actual Outcome\n\n```diff\n- Expected  - 1\n+ Received  + 1\n\n  Object {\n    \"data\": Object {\n      \"getAsyncIdentifiers\": Object {\n-       \"after\": \"first\",\n+       \"after\": \"second\",\n        \"before\": \"first\",\n      },\n    },\n  }\n```\n\n### Impact\n\nAny application that uses services that inject the context using `@ExecutionContext()` from a singleton provider are at risk. The more traffic an application has, the higher the chance for parallel requests, the higher the risk.",
  "id": "GHSA-53wg-r69p-v3r7",
  "modified": "2026-01-21T16:20:01Z",
  "published": "2026-01-16T21:09:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/graphql-hive/graphql-modules/security/advisories/GHSA-53wg-r69p-v3r7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23735"
    },
    {
      "type": "WEB",
      "url": "https://github.com/graphql-hive/graphql-modules/issues/2613"
    },
    {
      "type": "WEB",
      "url": "https://github.com/graphql-hive/graphql-modules/pull/2521"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/graphql-hive/graphql-modules"
    },
    {
      "type": "WEB",
      "url": "https://github.com/graphql-hive/graphql-modules/releases/tag/release-1768575025568"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "GraphQL Modules has a Race Condition issue"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-23735 (GCVE-0-2026-23735)

FKIE_CVE-2026-23735

GHSA-53WG-R69P-V3R7

Summary

Details

PoC

Expected vs. Actual Outcome

Impact

Tags

Sightings

Nomenclature

Related by attack behaviour