Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

We always support the latest versions. Try to use the latest versions as much as possible!

Reporting a Vulnerability

Please do not create issues about vulnerabilities. Contact us directly using our website instead. You can also read this article about npm audit.

Prototype pollution in well-established utility function `mergeDeep`
GHSA-7mx3-vvmw-hjmv published Sep 8, 2026 by ardatan

High
TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
GHSA-6fw5-9hq8-w87g published Sep 8, 2026 by ardatan

High

Learn more about advisories related to ardatan/graphql-tools in the GitHub Advisory Database