Executive brief
Mercurius, a GraphQL adapter for the Fastify web framework, is vulnerable to a denial-of-service attack. By sending a specially crafted, malformed JSON request to the GraphQL endpoint, an attacker can cause the server to crash due to an unhandled error. This can lead to service outages and impact business operations unless a custom error handler is in place.
Technical details
A vulnerability in Mercurius versions 8.10.0 through 8.11.1 allows remote attackers to cause a denial of service (DoS) via an uncaught exception. The issue stems from a regression in the default error handler where the 'context' object can be undefined when an error occurs during request parsing or within a hook. Specifically, the 'defaultErrorFormatter' attempts to read properties of an undefined object when processing malformed JSON sent to the /graphql endpoint. This results in a TypeError that crashes the Fastify process. The vulnerability is resolved in version 8.11.2 by adding proper checks for the existence of the context object in the error handling logic.
Affected products
- mercurius-js mercurius >= 8.10.0, < 8.11.2
Timeline
- 2021-12-01: patched: Fix merged into master branch
- 2021-12-13: advisory: GitHub Security Advisory published