Mercurius-js vulnerabilities
We track 2 vulnerabilities in Mercurius-js products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on March 6, 2026.
2vulnerabilities
0critical
2high
0exploited
7.8average CVSS score
Latest Mercurius-js vulnerabilities
- 8.2 High severity
mercurius: Incorrect Authorization
Mercurius is a GraphQL adapter for Fastify. Prior to version 16.8.0, Mercurius fails to enforce the configured queryDepth limit on GraphQL subscription queries received over WebSocket connections. The depth check is correctly applied to HTTP queries and mutati
- 7.5 High severity
mercurius: Uncaught Exception
Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to `/graphql`. This issue was patched in #940. As a workaround, users can disable s