CVE-2023-22477 — Mercurius is vulnerable to denial of service (DoS) when using subscriptions
Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket …
Published: 2023-01-09 · CVSS: 5.3 · CVSS 3.1
Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to `/graphql`. This issue was patched in #940. As a workaround, users can disable subscriptions.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7