CVE-2026-30241— Mercurius 安全漏洞

Mercurius: queryDepth limit bypassed for WebSocket subscriptions

Mercurius is a GraphQL adapter for Fastify. Prior to version 16.8.0, Mercurius fails to enforce the configured queryDepth limit on GraphQL subscription queries received over WebSocket connections. The depth check is correctly applied to HTTP queries and mutations, but subscription queries are parsed and executed without invoking the depth validation. This allows a remote client to submit arbitrarily deeply nested subscription queries over WebSocket, bypassing the intended depth restriction. On schemas with recursive types, this can lead to denial of service through exponential data resolution on each subscription event. This issue has been patched in version 16.8.0.

N/A

授权机制不正确

Mercurius 安全漏洞

Mercurius是mercurius-js开源的GraphQL适配器Fastify 。 Mercurius 16.8.0之前版本存在安全漏洞，该漏洞源于未对通过WebSocket连接接收的GraphQL订阅查询强制执行配置的queryDepth限制，可能导致远程客户端提交任意深度嵌套的订阅查询，绕过深度限制并可能导致拒绝服务。

N/A

N/A