CVE-2026-23735: 
JavaScript vulnerability analysis and mitigation

CVE-2026-23735 is a race condition vulnerability in the GraphQL Modules npm package (graphql-modules) that causes request execution contexts to be mixed up when two or more parallel requests trigger the same singleton service. The flaw affects versions 2.2.1 through before 2.4.1 and versions in the 3.x branch before 3.1.1. Because @ExecutionContext() is commonly used to pass authentication tokens from incoming requests to backend services, context confusion during concurrent processing can expose one user's authentication data to another's request. It was disclosed on January 16, 2026, with a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory).

The root cause is improper synchronization of shared state in singleton-scoped providers (CWE-362: Race Condition). When a singleton service uses the @ExecutionContext() decorator, the injected context is stored as a shared property on the singleton instance rather than being bound to the specific asynchronous execution chain. When two or more concurrent async requests both invoke the same singleton service, a timing window exists where one request's async execution can read the context object written by another concurrent request — for example, after an await yields control. The fix, implemented in PR #2521, uses Node.js async_hooks-based async context binding to tie the execution context to the correct async call chain, preventing cross-request context leakage (GitHub Advisory, Fix PR).

Successful exploitation allows authentication tokens or other sensitive context data from one user's concurrent request to be read by another user's request processed by the same singleton service. This can result in unauthorized access to backend APIs, privilege escalation (by using another user's token), and cross-user data exposure — particularly severe in multi-tenant or high-concurrency applications. The risk scales with traffic volume: the more parallel requests an application handles, the higher the probability of context collision (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been published beyond the test case included in the security advisory itself, and there is no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.185%, reflecting low current exploitation probability. However, the vulnerability is exploitable by any unauthenticated network attacker who can send concurrent requests to a vulnerable GraphQL endpoint, requiring no privileges or user interaction (GitHub Advisory, Feedly).

1. Identify a target: Locate a GraphQL API server running graphql-modules versions 2.2.1–2.4.0 or 3.0.x, where at least one singleton-scoped provider uses @ExecutionContext() to inject request context (e.g., for authentication tokens).
2. Craft two concurrent GraphQL requests: Prepare two valid GraphQL queries that both invoke a resolver backed by the vulnerable singleton service. Each request should carry a distinct authentication token or user identifier in its context.
3. Time the requests to overlap: Send both requests simultaneously so that the first request's async execution yields (e.g., during an await for a backend API call) while the second request begins processing and overwrites the shared singleton context property.
4. Observe context leakage: After the first request resumes from its await, the @ExecutionContext() property on the singleton now reflects the second request's context. The first request reads the second user's authentication token or data.
5. Leverage the leaked token: Use the obtained authentication token to make authenticated calls to backend APIs as the victim user, accessing their data or performing actions on their behalf (GitHub Advisory).

• Logs: GraphQL server logs showing the same singleton service returning data inconsistent with the requesting user's session (e.g., user A receiving data belonging to user B); backend API access logs showing requests authenticated with tokens that do not match the initiating user's session.
• Application Behavior: Reports from users receiving another user's data in GraphQL responses; unexpected authorization errors or data mismatches in high-concurrency periods.
• Network: Unusual patterns of near-simultaneous GraphQL requests to the same endpoint from different authenticated sessions, particularly if followed by anomalous backend API calls.

Note: No specific file system, registry, or process-level IOCs are associated with this vulnerability, as exploitation occurs entirely within the application's request-handling logic.

Upgrade graphql-modules to version 2.4.1 (for the 2.x branch) or 3.1.1 (for the 3.x branch) or later. The fix binds the execution context to the async call chain using Node.js async context tracking, preventing cross-request context leakage. No configuration-based workaround is available; the only effective remediation is upgrading to a patched version. Applications using singleton providers with @ExecutionContext() in high-concurrency or multi-tenant environments should treat this as a priority upgrade (GitHub Advisory, Fix PR).

The vulnerability was originally reported as a bug (issue #2613) by community member timon-roenisch-cpio in April 2025 before being elevated to a security advisory. Maintainer enisdenjo developed and merged the fix (PR #2521) on January 16, 2026, with remediation review by ardatan. Community members expressed appreciation for the fix, with one contributor noting they had already validated the alpha build resolved the race condition in their production setup. The fix introduced a minor performance trade-off due to the overhead of async_hooks, which was acknowledged by the maintainers (GitHub Issue, Fix PR).