Read the docs
TI-2026-19108 Aliases CVE-2026-23735GHSA-53wg-r69p-v3r7

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in graphql-modules

Priority HIGH 77CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

GraphQL Modules is a toolset of libraries and guidelines dedicated to create reusable, maintainable, testable and extendable modules out of your GraphQL server. From 2.2.1 to before 2.4.1 and 3.1.1, when 2 or more parallel requests are made which trigger the same service, the context of the requests is mixed up in the service when the context is injected via @ExecutionContext(). ExecutionContext is often used to pass authentication tokens from incoming requests to services loading data from backend APIs. This vulnerability is fixed in 2.4.1 and 3.1.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0056 46th percentileScored 2026-11-07
Fix Fixed graphql-modules (graphql-hive): 2.4.1, 3.1.1graphql-modules (npm): 2.4.1, 3.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
graphql-hivegraphql-modules2.2.1 to before 2.4.1; 3.0.0 to before 3.1.12.4.1, 3.1.1Patch availableCNA
—graphql-modules (npm)2.2.1 to before 2.4.12.4.1Patch availableGHSA-53wg-r69p-v3r7
—graphql-modules (npm)3.0.0 to before 3.1.13.1.1Patch availableGHSA-53wg-r69p-v3r7
  • graphql-modules Vendorgraphql-hive Affected 2.2.1 to before 2.4.1; 3.0.0 to before 3.1.1 Fixed in 2.4.1, 3.1.1 Patch available CNA
  • graphql-modules (npm) Vendor— Affected 2.2.1 to before 2.4.1 Fixed in 2.4.1 Patch available GHSA-53wg-r69p-v3r7
  • graphql-modules (npm) Vendor— Affected 3.0.0 to before 3.1.1 Fixed in 3.1.1 Patch available GHSA-53wg-r69p-v3r7

Remediation

  • Fix · CNA graphql-modules (graphql-hive) Fixed in 2.4.1, 3.1.1
  • Fix · GHSA-53wg-r69p-v3r7 graphql-modules (npm) Fixed in 2.4.1 Advisory →
  • Fix · GHSA-53wg-r69p-v3r7 graphql-modules (npm) Fixed in 3.1.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-23735
  2. 2026-10-03 Alias added: GHSA-53wg-r69p-v3r7

References

Advisory 1

Other 5

  • TI-2026-80000 Regex backtracking in graphql-scalars PhoneNumber scalar CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences