CVE-2023-22477
Mercurius is vulnerable to denial of service (DoS) when using subscriptions
Résumé
Mercurius is vulnerable to denial of service (DoS) when using subscriptions
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to /graphql. This issue was patched in #940. As a workaround, users can disable subscriptions.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- report github.com