Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Mercurius: queryDepth limit bypassed for WebSocket subscriptions
Vulnerability Description
Mercurius is a GraphQL adapter for Fastify. Prior to version 16.8.0, Mercurius fails to enforce the configured queryDepth limit on GraphQL subscription queries received over WebSocket connections. The depth check is correctly applied to HTTP queries and mutations, but subscription queries are parsed and executed without invoking the depth validation. This allows a remote client to submit arbitrarily deeply nested subscription queries over WebSocket, bypassing the intended depth restriction. On schemas with recursive types, this can lead to denial of service through exponential data resolution on each subscription event. This issue has been patched in version 16.8.0.
CVSS Information
N/A
Vulnerability Type
授权机制不正确
Vulnerability Title
Mercurius 安全漏洞
Vulnerability Description
Mercurius是mercurius-js开源的GraphQL适配器Fastify 。 Mercurius 16.8.0之前版本存在安全漏洞，该漏洞源于未对通过WebSocket连接接收的GraphQL订阅查询强制执行配置的queryDepth限制，可能导致远程客户端提交任意深度嵌套的订阅查询，绕过深度限制并可能导致拒绝服务。
CVSS Information
N/A
Vulnerability Type
N/A