MEDIUM5.3

GHSA-cm8h-q92v-xcfc

mercurius has Uncaught Exception when using subscriptions

Quick fix

GHSA-cm8h-q92v-xcfc — mercurius: upgrade to the fixed version with the command below.

npm install mercurius@11.5.0

Details

### Impact

Any users of Mercurius until version v11.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to `/graphql`.

### Patches

This was patched in https://github.com/mercurius-js/mercurius/pull/940. The patch was released as v11.5.0 and v8.13.2.

### Workarounds

Disable subscriptions.

### References

Reported publicly as https://github.com/mercurius-js/mercurius/issues/939. The same problem was solved in https://github.com/fastify/fastify-websocket/pull/228

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/mercurius

Introduced in: 9.0.0Fixed in: 11.5.0

Fixnpm install mercurius@11.5.0

npm/mercurius

Introduced in: 0Fixed in: 8.13.2

Fixnpm install mercurius@8.13.2

References

https://github.com/mercurius-js/mercurius/security/advisories/GHSA-cm8h-q92v-xcfc[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2023-22477[ADVISORY]
https://github.com/mercurius-js/mercurius/issues/939[WEB]
https://github.com/fastify/fastify-websocket/pull/228[WEB]
https://github.com/mercurius-js/mercurius/pull/940[WEB]
https://github.com/mercurius-js/mercurius[PACKAGE]