CVE-2023-22477: Denial of Service Vulnerability in mercurius
Summary
CVE-2023-22477: mercurius has Uncaught Exception when using subscriptions. Affects mercurius across 2 version ranges.
< 8.13.2
>= 9.0.0, < 11.5.0
Fixed in 8.13.2 or 11.5.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mercurius is an npm package that provides a GraphQL plugin for Fastify. It allows developers to build GraphQL APIs with ease. The package is widely used in various applications and versions prior to v11.5.0 are affected by a denial of service vulnerability. This vulnerability can be exploited by sending a malformed packet over WebSocket to the '/graphql' endpoint, resulting in a denial of service attack.
Vulnerability Detail
The vulnerability in Mercurius allows an attacker to launch a denial of service attack by sending a specially crafted packet over WebSocket to the '/graphql' endpoint. This can lead to the unavailability of the affected application, impacting its functionality and potentially disrupting its services. The vulnerability was patched in version v11.5.0 and v8.13.2 of Mercurius.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 8.13.28.13.2npm install mercurius@8.13.2 -
>= 9.0.0, < 11.5.011.5.0npm install mercurius@11.5.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to disable subscriptions in the application. This can be done by modifying the code to remove or comment out the subscription functionality. Here is an example of how to disable subscriptions in Mercurius:
const mercurius = require('mercurius');
const app = mercurius({
// ... other configuration options
subscription: false, // Disable subscriptions
});
Conclusion
The denial of service vulnerability in Mercurius can be mitigated by updating the package to the patched versions. If immediate updating is not possible, disabling subscriptions can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mercurius →
FAQ
The vulnerability allows an attacker to launch a denial of service attack, potentially rendering the affected application unavailable.
Versions prior to v11.5.0 and v8.13.2 of Mercurius are affected by this vulnerability.
To fix this vulnerability, update the Mercurius package to either v11.5.0 or v8.13.2.
Yes, you can temporarily disable subscriptions in the application as a workaround for this vulnerability.
You can find more information about this vulnerability in the GitHub advisory database and the GitHub issue tracker for Mercurius.
References
Related vulnerabilities
Recent vulnerabilities recorded for mercurius.
