Advisory Database
  • Advisories
  • Dependency Scanning
  1. npm
  2. ›
  3. @envelop/graphql-modules
  4. ›
  5. GHSA-h3hw-29fv-2x75

GHSA-h3hw-29fv-2x75: @envelop/graphql-modules has a Race Condition vulnerability

January 21, 2026 (updated January 29, 2026)

Context race condition when using useGraphQLModules plugin

References

  • github.com/advisories/GHSA-h3hw-29fv-2x75
  • github.com/graphql-hive/envelop
  • github.com/graphql-hive/envelop/commit/ab49fa259a51d976c437e084114e070b99720ba9
  • github.com/graphql-hive/envelop/releases/tag/release-1768928934700
  • github.com/graphql-hive/envelop/security/advisories/GHSA-h3hw-29fv-2x75
  • github.com/graphql-hive/graphql-modules/security/advisories/GHSA-53wg-r69p-v3r7

Code Behaviors & Features

Detect and mitigate GHSA-h3hw-29fv-2x75 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 9.1.0

Fixed versions

  • 9.1.0

Solution

Upgrade to version 9.1.0 or above.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Learn more about CVSS

Weakness

  • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Source file

npm/@envelop/graphql-modules/GHSA-h3hw-29fv-2x75.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 04 Feb 2026 00:35:59 +0000.