Mercurius: queryDepth limit bypassed for WebSocket subscriptions
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.
Summary
Mercurius is a GraphQL adapter for Fastify. Prior to version 16.8.0, Mercurius fails to enforce the configured queryDepth limit on GraphQL subscription queries received over WebSocket connections. The depth check is correctly applied to HTTP queries and mutations, but subscription queries are parsed and executed without invoking the depth validation. This allows a remote client to submit arbitrarily deeply nested subscription queries over WebSocket, bypassing the intended depth restriction. On schemas with recursive types, this can lead to denial of service through exponential data resolution on each subscription event. This issue has been patched in version 16.8.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| mercurius-js | mercurius | before 16.8.0 | 16.8.0 | Patch available | CNA |
| — | mercurius (npm) | before 16.8.0 | 16.8.0 | Patch available | GHSA-m4h2-mjfm-mp55 |
- mercurius Vendormercurius-js Affected before 16.8.0 Fixed in 16.8.0 Patch available CNA
- mercurius (npm) Vendor— Affected before 16.8.0 Fixed in 16.8.0 Patch available GHSA-m4h2-mjfm-mp55
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mercurius_project:mercurius:*:*:*:*:*:node.js:*:* | before 16.8.0 | Vulnerable | mercurius-js |
- cpe:2.3:a:mercurius_project:mercurius:*:*:*:*:*:node.js:*:* Versions before 16.8.0 Vulnerable ·mercurius-js
Remediation
- Fix · CNA mercurius (mercurius-js) Fixed in 16.8.0
- Fix · GHSA-m4h2-mjfm-mp55 mercurius (npm) Fixed in 16.8.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-30241
- 2026-10-03 Alias added: GHSA-m4h2-mjfm-mp55
References
More mercurius-js Mercurius vulnerabilities
- TI-2023-08726 Mercurius is vulnerable to denial of service (DoS) when using subscriptions CVSS 3.1HIGH 7.5
- TI-2025-39610 Mercurius: Incorrect Content-Type parsing can lead to CSRF attack CVSS 3.1MEDIUM 5.4
- TI-2021-19607 Uncaught Exception in mercurius CVSS 3.1HIGH 7.5
Sources
- CVE-2026-30241 · CVE Program
- CVE-2026-30241 · NVD
- FIRST EPSS
- GHSA-m4h2-mjfm-mp55 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences