GHSA-H3HW-29FV-2X75

Context Bleeding: When GraphQL Requests Swap Identities in Envelop

Alon Barad
Alon Barad
Software Engineer

Jan 21, 2026·6 min read·5 visits

Executive Summary (TL;DR)

The `@envelop/graphql-modules` plugin failed to properly isolate request contexts during asynchronous operations. By manually managing the `OperationController` lifecycle instead of using the framework's execution wrappers, the plugin introduced a race condition. If two requests occurred simultaneously, the second request could overwrite the context of the first, leading to severe data leakage and potential account takeovers.

A critical race condition in the @envelop/graphql-modules plugin allowed execution contexts to bleed across concurrent requests. This flaw meant that under load, one user's authentication token or session data could potentially be accessed by another user's operation.

Fix Analysis (1)

Technical Appendix

CVSS Score
8.7/ 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Probability
0.04%
Top 100% most exploited

Affected Systems

@envelop/graphql-modules npm packageGraphQL servers using Envelop and GraphQL ModulesNode.js applications relying on @ExecutionContext for auth

Affected Versions Detail

Product
Affected Versions
Fixed Version
@envelop/graphql-modules
The Guild
< [Patched Version]Latest
AttributeDetail
Vulnerability TypeRace Condition / Context Bleeding
SeverityHigh (Data Leakage / Auth Bypass)
Affected Component@envelop/graphql-modules
Attack VectorNetwork (Concurrent Requests)
CVSS Estimate8.7 (High)
Fix Commitab49fa25...
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a race condition in a concurrent environment, allowing unauthorized access to data or resources.

Vulnerability Timeline

Fix committed to GitHub
2026-01-20
Proof of Concept test case added
2026-01-20

Subscribe to updates

Get the latest CVE analysis reports delivered to your inbox.