Is CVE-2021-43801 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-43801 being exploited in the wild.

How severe is CVE-2021-43801?

Low severity, with a CVSS score of 3.1, published 13 December 2021.

Which products and versions are affected?

mercurius (npm) SEMVER:introduced=8.10.0,fixed=8.11.2.

Is there a fix for CVE-2021-43801?

Yes. mercurius (npm): upgrade to 8.11.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-43801 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2021-43801?

Check whether you run mercurius (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-43801: mercurius-js mercurius denial of service via uncaught exception

CVE-2021-43801 · Severity: low · CVSS 3.1 · Published 2021-12-13

Mercurius, a GraphQL adapter for the Fastify web framework, is vulnerable to a denial-of-service attack. By sending a specially crafted, malformed JSON request to the GraphQL endpoint, an attacker can cause the server to crash due to an unhandled error. This can lead to service outages and impact business operations unless a custom error handler is in place.

Technologies: mercurius (npm). Vendors: npm.

Quick answers

Is CVE-2021-43801 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-43801 being exploited in the wild.
How severe is CVE-2021-43801?: Low severity, with a CVSS score of 3.1, published 13 December 2021.
Which products and versions are affected?: mercurius (npm) SEMVER:introduced=8.10.0,fixed=8.11.2.
Is there a fix for CVE-2021-43801?: Yes. mercurius (npm): upgrade to 8.11.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-43801 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2021-43801?: Check whether you run mercurius (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mercurius (npm): upgrade to 8.11.2 or later
```
npm install mercurius@8.11.2
```

Technical details

A vulnerability in Mercurius versions 8.10.0 through 8.11.1 allows remote attackers to cause a denial of service (DoS) via an uncaught exception. The issue stems from a regression in the default error handler where the 'context' object can be undefined when an error occurs during request parsing or within a hook. Specifically, the 'defaultErrorFormatter' attempts to read properties of an undefined object when processing malformed JSON sent to the /graphql endpoint. This results in a TypeError that crashes the Fastify process. The vulnerability is resolved in version 8.11.2 by adding proper checks for the existence of the context object in the error handling logic.

Affected products

mercurius-js mercurius >= 8.10.0, < 8.11.2

Identifiers

CVE-2021-43801
GHSA-273r-rm8g-7f3x

Timeline

2021-12-01: patched: Fix merged into master branch
2021-12-13: advisory: GitHub Security Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.