CVE-2026-118666 — GraphQL Tools shared legacy executor routes one subscription’s results to a different caller

When a shared @graphql-tools/executor-legacy-ws instance is used, one user’s GraphQL subscription results may be delivered to another user’s observer. The original subscription stream may simultaneously stop receiving results. The source reports dynamic reproduction on versions 1.1.33 and 1.1.35 and states that the issue is fixed in version 1.1.36.