Skip to content
OpenAdvisories

Package · npm

mercurius

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Low 2.7
    CVE-2026-30241

    Mercurius: queryDepth limit bypassed for WebSocket subscriptions

    Mercurius is a GraphQL adapter for Fastify. Prior to version 16.8.0, Mercurius fails to enforce the configured queryDepth limit on GraphQL subscription queries received over WebSocket connections. The depth check is correctly applied to HTTP queries and mutat…

    mercurius-js mercurius mercurius npm
  • Medium 5.4
    CVE-2025-64166

    Mercurius: Incorrect Content-Type parsing can lead to CSRF attack

    Mercurius is a GraphQL adapter for Fastify. Prior to version 16.4.0, a cross-site request forgery (CSRF) vulnerability was identified. The issue arises from incorrect parsing of the Content-Type header in requests. Specifically, requests with Content-Type val…

    mercurius-js mercurius mercurius npm
  • Medium 5.3
    CVE-2023-22477

    Mercurius is vulnerable to denial of service (DoS) when using subscriptions

    Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to `/graphql`. This issue was patched in #940. As a workaround, users can disable …

    mercurius-js mercurius mercurius npm
  • High 7.5
    CVE-2021-43801

    Uncaught Exception in mercurius

    Mercurius is a GraphQL adapter for Fastify. Any users from Mercurius@8.10.0 to 8.11.1 are subjected to a denial of service attack by sending a malformed JSON to `/graphql` unless they are using a custom error handler. The vulnerability has been fixed in https…

    mercurius-js mercurius mercurius npm