CVE-2026-30241 Details
Description
Mercurius is a GraphQL adapter for Fastify. Prior to version 16.8.0, Mercurius fails to enforce the configured queryDepth limit on GraphQL subscription queries received over WebSocket connections. The depth check is correctly applied to HTTP queries and mutations, but subscription queries are parsed and executed without invoking the depth validation. This allows a remote client to submit arbitrarily deeply nested subscription queries over WebSocket, bypassing the intended depth restriction. On schemas with recursive types, this can lead to denial of service through exponential data resolution on each subscription event. This issue has been patched in version 16.8.0.
A vulnerability exists in Mercurius, a GraphQL adapter for Fastify, in versions prior to 16.8.0. The issue arises because Mercurius does not properly enforce the configured query depth limit on GraphQL subscription queries received over WebSocket connections. While the depth check is correctly applied to HTTP queries and mutations, subscription queries are executed without the necessary depth validation. This flaw allows remote clients to send deeply nested subscription queries over WebSocket, circumventing the intended depth restrictions. In schemas with recursive types, this could result in a denial-of-service condition due to exponential data resolution for each subscription event.
Users can upgrade to Mercurius version 16.8.0 or later, where this vulnerability has been patched. Alternatively, subscriptions and queries over WebSocket can be disabled.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mercurius project mercurius | < 16.8.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 12, 2026 | Initial Analysis | [email protected] |
| Mar 6, 2026 | New CVE Received | [email protected] |