CVE-2026-30241: Mercurius WebSocket Subscription Query Depth Limit Bypass
Summary
CVE-2026-30241: Mercurius's queryDepth limit bypassed for WebSocket subscriptions. Affects mercurius versions < 16.8.0. Fixed in 16.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mercurius is a popular GraphQL adapter for Fastify, designed to facilitate the integration of GraphQL APIs into Fastify applications. It allows developers to build efficient and scalable APIs with features like schema stitching, subscriptions, and middleware support. However, Mercurius has a vulnerability that affects its handling of WebSocket subscription queries, which can lead to potential denial of service attacks.
Vulnerability Detail
The vulnerability arises from Mercurius's failure to enforce the configured queryDepth limit on GraphQL subscription queries received over WebSocket connections. While the depth check is correctly applied to HTTP queries and mutations, subscription queries bypass this validation. This oversight allows a remote client to submit deeply nested subscription queries, which can lead to exponential data resolution on each subscription event, potentially resulting in a denial of service.
How To Fix
Minimum fixed version
16.8.0
This is the first release that contains the fix.
npm install mercurius@16.8.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable subscriptions and any queries over WebSocket connections to mitigate the risk associated with this vulnerability. This can be done by modifying your server configuration to not allow WebSocket subscriptions.
Conclusion
In summary, the Mercurius package has a vulnerability that allows for the bypassing of query depth limits on WebSocket subscriptions, potentially leading to denial of service. It is crucial to update to version 16.8.0 or later to mitigate this risk. Additionally, disabling WebSocket subscriptions can serve as a temporary workaround.
See every vulnerability recorded for mercurius →
FAQ
The vulnerability allows for the bypassing of query depth limits on WebSocket subscription queries, which can lead to denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to denial of service through excessive resource consumption due to deeply nested subscription queries.
Yes, a patch is available in version 16.8.0 of the Mercurius package. Updating to this version will resolve the vulnerability.
The CVSS score of this vulnerability is 2.7, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for mercurius.
