Skip to content
OpenAdvisories

Package · npm

mercurius

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 2.7
    CVE-2026-30241

    Mercurius: queryDepth limit bypassed for WebSocket subscriptions

    Mercurius is a GraphQL adapter for Fastify. Prior to version 16.8.0, Mercurius fails to enforce the configured queryDepth limit on GraphQL subscription queries received over WebSocket connections. The depth check is correctly applied to HTTP queries and mutat…

    mercurius-js mercurius mercurius npm