Context Injection Flaw in GraphQL Modules Affects Service Integrity
CVE-2026-23735
What is CVE-2026-23735?
GraphQL Modules, a library toolkit for building reusable and maintainable GraphQL modules, contains a context injection flaw that arises when multiple parallel requests are made to the same service. In versions from 2.2.1 up to (but not including) 2.4.1 and 3.1.1, this vulnerability compromises the proper isolation of request contexts; specifically, the misuse of the @ExecutionContext() decorator can lead to the mixing of authentication tokens and context data between requests. This glitch could allow unauthorized data access or operations. The issue has been addressed in subsequent releases, specifically versions 2.4.1 and 3.1.1, where appropriate mitigations have been implemented.
Affected Version(s)
graphql-modules >= 2.2.1, < 2.4.1 < 2.2.1, 2.4.1
graphql-modules >= 3.0.0, < 3.1.1 < 3.0.0, 3.1.1