mercurius has Uncaught Exception when using subscriptions
Moderate severity
GitHub Reviewed
Published
Jan 8, 2023
in
mercurius-js/mercurius
•
Updated Feb 3, 2023
Package
Affected versions
>= 9.0.0, < 11.5.0
< 8.13.2
Patched versions
11.5.0
8.13.2
Description
Published by the National Vulnerability Database
Jan 9, 2023
Published to the GitHub Advisory Database
Jan 9, 2023
Reviewed
Jan 9, 2023
Last updated
Feb 3, 2023
Credits
-
marcolanaro Analyst
Impact
Any users of Mercurius until version v11.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to
/graphql.Patches
This was patched in mercurius-js/mercurius#940.
The patch was released as v11.5.0 and v8.13.2.
Workarounds
Disable subscriptions.
References
Reported publicly as mercurius-js/mercurius#939.
The same problem was solved in fastify/fastify-websocket#228
References