CVE-2023-22477
Mercurius is vulnerable to denial of service (DoS) when using subscriptions
Summary
Mercurius is vulnerable to denial of service (DoS) when using subscriptions
Original description
The description as published by the source.
Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to /graphql. This issue was patched in #940. As a workaround, users can disable subscriptions.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- report github.com