Executive brief
GraphQL Modules is a framework for building GraphQL servers. It contains a race condition in how it handles execution context across concurrent requests, which can cause authentication tokens and other request-specific data to be mixed between parallel requests. An attacker sending concurrent requests could potentially access data intended for another user or escalate privileges by getting another user's authentication context.
Technical details
The vulnerability is a classic race condition (CWE-362) in the context management of GraphQL Modules. When multiple parallel GraphQL requests are processed and use the @ExecutionContext() decorator to inject context into singleton-scoped providers, the context values become intermingled. The root cause is improper synchronization of shared resources (the execution context) across concurrent async operations. An attacker with network access can exploit this by sending multiple requests simultaneously, causing the framework to return data from one request context to another. The vulnerability affects versions 2.2.1–2.4.0 and 3.0.0–3.1.0; patches are available in 2.4.1 and 3.1.1 which bind context to async execution using Node.js AsyncLocalStorage or similar mechanisms.
Affected products
- graphql-hive graphql-modules 2.2.1 through 2.4.0, 3.0.0 through 3.1.0
Timeline
- 2026-01-16: disclosed: Advisory published
- 2026-01-16: patched: Versions 2.4.1 and 3.1.1 released
References
- https://github.com/graphql-hive/graphql-modules/security/advisories/GHSA-53wg-r69p-v3r7
- https://github.com/graphql-hive/graphql-modules/issues/2613
- https://github.com/graphql-hive/graphql-modules/pull/2521
- https://github.com/graphql-hive/graphql-modules
- https://github.com/graphql-hive/graphql-modules/releases/tag/release-1768575025568