Threats affecting pkg:github/graphql-hive/graphql-modules

CVE-2026-23735 is a high-severity race condition vulnerability in graphql-hive's graphql-modules versions 2.2.1 to before 2.4.1 and 3.0.0 to before 3.1.1. The flaw occurs when multiple parallel requests trigger the same service, causing request contexts—often containing sensitive authentication tokens—to be mixed up due to improper synchronization in the @ExecutionContext() injection.