CVE-2021-43801: Denial of Service Vulnerability in Mercurius
Summary
CVE-2021-43801: Uncaught Exception in mercurius. Affects mercurius versions >= 8.10.0, < 8.11.2. Fixed in 8.11.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mercurius is an npm package that provides a GraphQL HTTP server for Node.js applications. It allows developers to build GraphQL APIs with ease. The vulnerability affects versions 8.10.0 to 8.11.1 of the Mercurius package. It can be exploited by sending a malformed JSON payload to the /graphql endpoint, leading to a denial of service attack. However, users who have implemented a custom error handler are not affected.
Vulnerability Detail
The vulnerability in Mercurius allows an attacker to perform a denial of service attack by sending a specially crafted JSON payload to the /graphql endpoint. This can cause the server to crash or become unresponsive, disrupting the normal operation of the application. The vulnerability has been assigned a CVSS score of 7.5, indicating a high severity level. It was identified and reported in GitHub Advisory Database as GHSA-273r-rm8g-7f3x.
How To Fix
Minimum fixed version
8.11.2
This is the first release that contains the fix.
npm install mercurius@8.11.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a workaround for this vulnerability is to implement a custom error handler in the application. By handling the error appropriately, the application can mitigate the impact of the malformed JSON payload and prevent the denial of service attack. Implementing a custom error handler requires modifying the application code to handle the specific error condition caused by the vulnerability.
Conclusion
The vulnerability in the Mercurius package allows for a denial of service attack by sending a malformed JSON payload to the /graphql endpoint. It is recommended to update the package to version 8.11.2 or later to fix the vulnerability. Alternatively, implementing a custom error handler can mitigate the impact of the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mercurius →
FAQ
The vulnerability allows an attacker to perform a denial of service attack on applications using the affected versions of the Mercurius package. This can lead to service disruption and unavailability of the application.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide the package-lock.json file of your application, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, the vulnerability has been fixed in version 8.11.2 of the Mercurius package. It is recommended to update to this version or later to patch the vulnerability.
Yes, you can implement a custom error handler in your application to mitigate the impact of the vulnerability. By handling the error appropriately, you can prevent the denial of service attack caused by the malformed JSON payload.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/mercurius-js/mercurius/issues/677.
References
Related vulnerabilities
Recent vulnerabilities recorded for mercurius.
