| Package | Affected versions | Patched versions |
|---|---|---|
| mercurius | ≥ 9.0.0, < 11.5.0< 8.13.2 | 11.5.08.13.2 |
| mercurius | ≥ 9.0.0, < 11.5.0< 8.13.2 | 11.5.08.13.2 |
Any users of Mercurius until version v11.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to /graphql.
This was patched in https://github.com/mercurius-js/mercurius/pull/940. The patch was released as v11.5.0 and v8.13.2.
Disable subscriptions.
Reported publicly as https://github.com/mercurius-js/mercurius/issues/939. The same problem was solved in https://github.com/fastify/fastify-websocket/pull/228
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free