Executive brief
Mercurius is a GraphQL server library for Node.js that provides real-time subscriptions over WebSocket. An attacker can cause the service to crash by sending a malformed WebSocket packet to the GraphQL endpoint, resulting in an uncaught exception that terminates the application and causes denial of service.
Technical details
This vulnerability is caused by an uncaught exception (CWE-248) when processing malformed WebSocket packets sent to the /graphql subscription endpoint. The attack requires no authentication or user interaction and is triggered by sending a crafted packet over the network via WebSocket. Any user running Mercurius versions 9.0.0 through 11.4.x or versions prior to 8.13.2 is vulnerable to having their GraphQL service crash. The vulnerability was patched in v11.5.0 and v8.13.2, with the fix properly handling and validating incoming subscription packets to prevent exception propagation.
Affected products
- Mercurius mercurius <8.13.2, >=9.0.0, <11.5.0
Timeline
- 2023-01-09: disclosed: Vulnerability published publicly
- 2023-01-09: patched: Patched in v11.5.0 and v8.13.2