# CVE-2021-43801: mercurius-js mercurius denial of service via uncaught exception

Source: https://junglewise.ai/threats/cve-2021-43801-mercurius-js-mercurius-denial-of-service-via-uncaught-exception  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-12-13. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2021-43801 · Severity: low · CVSS 3.1 · Published 2021-12-13

Mercurius, a GraphQL adapter for the Fastify web framework, is vulnerable to a denial-of-service attack. By sending a specially crafted, malformed JSON request to the GraphQL endpoint, an attacker can cause the server to crash due to an unhandled error. This can lead to service outages and impact business operations unless a custom error handler is in place.

Technologies: [mercurius (npm)](https://junglewise.ai/threats/technologies/mercurius). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-43801 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-43801 being exploited in the wild.

**How severe is CVE-2021-43801?** Low severity, with a CVSS score of 3.1, published 13 December 2021.

**Which products and versions are affected?** mercurius (npm) SEMVER:introduced=8.10.0,fixed=8.11.2.

**Is there a fix for CVE-2021-43801?** Yes. mercurius (npm): upgrade to 8.11.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-43801 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-43801?** Check whether you run mercurius (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mercurius (npm): upgrade to 8.11.2 or later

  ```sh
  npm install mercurius@8.11.2
  ```


## Technical details

A vulnerability in Mercurius versions 8.10.0 through 8.11.1 allows remote attackers to cause a denial of service (DoS) via an uncaught exception. The issue stems from a regression in the default error handler where the 'context' object can be undefined when an error occurs during request parsing or within a hook. Specifically, the 'defaultErrorFormatter' attempts to read properties of an undefined object when processing malformed JSON sent to the /graphql endpoint. This results in a TypeError that crashes the Fastify process. The vulnerability is resolved in version 8.11.2 by adding proper checks for the existence of the context object in the error handling logic.

## Affected products

- mercurius-js mercurius >= 8.10.0, < 8.11.2

## Identifiers

- CVE-2021-43801
- GHSA-273r-rm8g-7f3x

## Timeline

- 2021-12-01: patched: Fix merged into master branch
- 2021-12-13: advisory: GitHub Security Advisory published

## References

- [https://github.com/mercurius-js/mercurius/security/advisories/GHSA-273r-rm8g-7f3x](https://github.com/mercurius-js/mercurius/security/advisories/GHSA-273r-rm8g-7f3x)
- [https://github.com/mercurius-js/mercurius/issues/677](https://github.com/mercurius-js/mercurius/issues/677)
- [https://github.com/mercurius-js/mercurius/pull/678/commits/732b2f895312da8deadd7b173dcd2d141d54b223](https://github.com/mercurius-js/mercurius/pull/678/commits/732b2f895312da8deadd7b173dcd2d141d54b223)
- [https://github.com/mercurius-js/mercurius](https://github.com/mercurius-js/mercurius)

## Related threats

- [Mercurius queryDepth limit bypass in WebSocket subscriptions](https://junglewise.ai/threats/cve-2026-30241-mercurius-querydepth-limit-bypass-in-websocket-subscriptions)
- [Mercurius incorrect Content-Type parsing CSRF vulnerability](https://junglewise.ai/threats/cve-2025-64166-mercurius-incorrect-content-type-parsing-csrf-vulnerability)
- [mercurius uncaught exception in subscriptions](https://junglewise.ai/threats/cve-2023-22477-mercurius-uncaught-exception-in-subscriptions)