CVE-2026-30241

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30241", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-04T17:23:59.799Z", "datePublished": "2026-03-06T21:15:33.433Z", "dateUpdated": "2026-03-09T20:54:28.446Z"}, "containers": {"cna": {"title": "Mercurius: queryDepth limit bypassed for WebSocket subscriptions", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/mercurius-js/mercurius/security/advisories/GHSA-m4h2-mjfm-mp55", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mercurius-js/mercurius/security/advisories/GHSA-m4h2-mjfm-mp55"}, {"name": "https://github.com/mercurius-js/mercurius/commit/5b56f60f4b0d60780b0ff499a479bd830bdd6986", "tags": ["x_refsource_MISC"], "url": "https://github.com/mercurius-js/mercurius/commit/5b56f60f4b0d60780b0ff499a479bd830bdd6986"}], "affected": [{"vendor": "mercurius-js", "product": "mercurius", "versions": [{"version": "< 16.8.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T21:15:33.433Z"}, "descriptions": [{"lang": "en", "value": "Mercurius is a GraphQL adapter for Fastify. Prior to version 16.8.0, Mercurius fails to enforce the configured queryDepth limit on GraphQL subscription queries received over WebSocket connections. The depth check is correctly applied to HTTP queries and mutations, but subscription queries are parsed and executed without invoking the depth validation. This allows a remote client to submit arbitrarily deeply nested subscription queries over WebSocket, bypassing the intended depth restriction. On schemas with recursive types, this can lead to denial of service through exponential data resolution on each subscription event. This issue has been patched in version 16.8.0."}], "source": {"advisory": "GHSA-m4h2-mjfm-mp55", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30241", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T20:44:23.547122Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T20:54:28.446Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30241", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T20:44:23.547122Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T20:47:26.257Z"}}], "cna": {"title": "Mercurius: queryDepth limit bypassed for WebSocket subscriptions", "source": {"advisory": "GHSA-m4h2-mjfm-mp55", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "mercurius-js", "product": "mercurius", "versions": [{"status": "affected", "version": "< 16.8.0"}]}], "references": [{"url": "https://github.com/mercurius-js/mercurius/security/advisories/GHSA-m4h2-mjfm-mp55", "name": "https://github.com/mercurius-js/mercurius/security/advisories/GHSA-m4h2-mjfm-mp55", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/mercurius-js/mercurius/commit/5b56f60f4b0d60780b0ff499a479bd830bdd6986", "name": "https://github.com/mercurius-js/mercurius/commit/5b56f60f4b0d60780b0ff499a479bd830bdd6986", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Mercurius is a GraphQL adapter for Fastify. Prior to version 16.8.0, Mercurius fails to enforce the configured queryDepth limit on GraphQL subscription queries received over WebSocket connections. The depth check is correctly applied to HTTP queries and mutations, but subscription queries are parsed and executed without invoking the depth validation. This allows a remote client to submit arbitrarily deeply nested subscription queries over WebSocket, bypassing the intended depth restriction. On schemas with recursive types, this can lead to denial of service through exponential data resolution on each subscription event. This issue has been patched in version 16.8.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T21:15:33.433Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30241", "state": "PUBLISHED", "dateUpdated": "2026-03-09T20:54:28.446Z", "dateReserved": "2026-03-04T17:23:59.799Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-06T21:15:33.433Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mercurius", "vendor": "mercurius-js", "versions": [{"status": "affected", "version": "< 16.8.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mercurius_project:mercurius:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "D17316EB-4DF9-485E-87DC-C84C68FAC0AF", "versionEndExcluding": "16.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mercurius is a GraphQL adapter for Fastify. Prior to version 16.8.0, Mercurius fails to enforce the configured queryDepth limit on GraphQL subscription queries received over WebSocket connections. The depth check is correctly applied to HTTP queries and mutations, but subscription queries are parsed and executed without invoking the depth validation. This allows a remote client to submit arbitrarily deeply nested subscription queries over WebSocket, bypassing the intended depth restriction. On schemas with recursive types, this can lead to denial of service through exponential data resolution on each subscription event. This issue has been patched in version 16.8.0."}, {"lang": "es", "value": "Mercurius es un adaptador GraphQL para Fastify. Antes de la versi\u00f3n 16.8.0, Mercurius no aplica el l\u00edmite de queryDepth configurado en las consultas de suscripci\u00f3n GraphQL recibidas a trav\u00e9s de conexiones WebSocket. La verificaci\u00f3n de profundidad se aplica correctamente a las consultas y mutaciones HTTP, pero las consultas de suscripci\u00f3n se analizan y ejecutan sin invocar la validaci\u00f3n de profundidad. Esto permite a un cliente remoto enviar consultas de suscripci\u00f3n anidadas arbitrariamente profundas a trav\u00e9s de WebSocket, eludiendo la restricci\u00f3n de profundidad prevista. En esquemas con tipos recursivos, esto puede llevar a una denegaci\u00f3n de servicio a trav\u00e9s de la resoluci\u00f3n exponencial de datos en cada evento de suscripci\u00f3n. Este problema ha sido parcheado en la versi\u00f3n 16.8.0."}], "id": "CVE-2026-30241", "lastModified": "2026-06-17T10:32:33.040", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30241", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T20:44:23.547122Z", "version": "2.0.3"}}]}, "published": "2026-03-06T22:16:01.587", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/mercurius-js/mercurius/commit/5b56f60f4b0d60780b0ff499a479bd830bdd6986"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/mercurius-js/mercurius/security/advisories/GHSA-m4h2-mjfm-mp55"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,16.8.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "mercurius", "source": "cna", "vendor": "mercurius-js"}, "product": "mercurius", "vendor": "mercurius-js"}], "analysis": {"en": {"generated_at": "2026-04-18T09:48:59.169810+00:00", "value": {"mitigation_remediation": ["Upgrade Mercurius to version 16.8.0 or later.", "Configure a stricter queryDepth limit for subscription queries, ensuring validation is enforced.", "Monitor subscription activity and system resource usage for abnormal spikes; consider rate\u2011limiting WebSocket subscriptions."], "summary": {"action": "Patch Now", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The issue affects Mercurius version 16.7.x and earlier. Any deployment using the mercurius npm package via Node.js that serves GraphQL subscriptions over WebSocket is vulnerable until the vendor releases version 16.8.0.", "description_and_impact": "Mercurius is a GraphQL adapter for Fastify that enforces a queryDepth limit on client requests. Prior to version 16.8.0 the limit is applied to HTTP queries and mutations but is omitted for subscription queries received via WebSocket. An attacker can send a subscription with arbitrary nesting depth, causing the server to resolve deeply nested fields for every subscription event. This leads to a denial\u2011of\u2011service condition due to exponential data resolution when the schema contains recursive types.", "risk_and_exploitability": "The CVSS score is 2.7, indicating low severity, implying a very small likelihood of exploitation in the wild. The EPSS score is less than 1%, indicating a very low probability of exploitation in the wild. The flaw can be exploited remotely by any client that can establish a WebSocket connection to the GraphQL endpoint; the injection of deeply nested subscription queries is the likely attack vector. Since the vulnerability is limited to subscription operations on WebSocket, an attacker needs prior access to a WebSocket\u2011enabled GraphQL server."}}}}, "created": "2026-03-09T10:06:48.703556+00:00", "updated": "2026-04-18T10:00:10.314206+00:00", "vendors": ["mercurius-js", "mercurius-js$PRODUCT$mercurius"]}