漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Mercurius: queryDepth limit bypassed for WebSocket subscriptions
Vulnerability Description
Mercurius is a GraphQL adapter for Fastify. Prior to version 16.8.0, Mercurius fails to enforce the configured queryDepth limit on GraphQL subscription queries received over WebSocket connections. The depth check is correctly applied to HTTP queries and mutations, but subscription queries are parsed and executed without invoking the depth validation. This allows a remote client to submit arbitrarily deeply nested subscription queries over WebSocket, bypassing the intended depth restriction. On schemas with recursive types, this can lead to denial of service through exponential data resolution on each subscription event. This issue has been patched in version 16.8.0.
CVSS Information
N/A
Vulnerability Type
授权机制不正确
Vulnerability Title
Mercurius 安全漏洞
Vulnerability Description
Mercurius是mercurius-js开源的GraphQL适配器Fastify 。 Mercurius 16.8.0之前版本存在安全漏洞，该漏洞源于未对通过WebSocket连接接收的GraphQL订阅查询强制执行配置的queryDepth限制，可能导致远程客户端提交任意深度嵌套的订阅查询，绕过深度限制并可能导致拒绝服务。
CVSS Information
N/A
Vulnerability Type
N/A