Skip to content
OpenAdvisories

Package · npm

mercurius

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.4
    CVE-2025-64166

    Mercurius: Incorrect Content-Type parsing can lead to CSRF attack

    Mercurius is a GraphQL adapter for Fastify. Prior to version 16.4.0, a cross-site request forgery (CSRF) vulnerability was identified. The issue arises from incorrect parsing of the Content-Type header in requests. Specifically, requests with Content-Type val…

    mercurius-js mercurius mercurius npm
  • Medium 5.3
    CVE-2023-22477

    Mercurius is vulnerable to denial of service (DoS) when using subscriptions

    Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to `/graphql`. This issue was patched in #940. As a workaround, users can disable …

    mercurius-js mercurius mercurius npm