GHSA-9w87-4j72-gcv7
Insecure Default Configuration in graphql-code-generator
Versions of graphql-code-generator prior to 0.18.2 have an Insecure Default Configuration. The packages sets NODE_TLS_REJECT_UNAUTHORIZED to 0, disabling certificate verification for the entire project. This results in Insecure Communication for the process.
Recommendation
Upgrade to version 0.18.2 or later.
What each source reports
GitHub AdvisoriesNo score
Insecure Default Configuration in graphql-code-generator
Versions of graphql-code-generator prior to 0.18.2 have an Insecure Default Configuration. The packages sets NODE_TLS_REJECT_UNAUTHORIZED to 0, disabling certificate verification for the entire project. This results in Insecure Communication for the process.
Recommendation
Upgrade to version 0.18.2 or later.
- Record
GHSA-9w87-4j72-gcv7- Updated
- 2026-11-02
OSVNo score
Insecure Default Configuration in graphql-code-generator
Versions of graphql-code-generator prior to 0.18.2 have an Insecure Default Configuration. The packages sets NODE_TLS_REJECT_UNAUTHORIZED to 0, disabling certificate verification for the entire project. This results in Insecure Communication for the process.
Recommendation
Upgrade to version 0.18.2 or later.
- Record
GHSA-9w87-4j72-gcv7- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
graphql-code-generatornpm | before 0.18.2 | 0.18.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-9w87-4j72-gcv7 is a vulnerability with no CVSS score yet in graphql-code-generator, published September 2, 2020. No source lists public exploit code. Fixed in graphql-code-generator 0.18.2.