# CVE-2023-22477: mercurius uncaught exception in subscriptions

Source: https://junglewise.ai/threats/cve-2023-22477-mercurius-uncaught-exception-in-subscriptions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-01-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-22477 · Severity: low · CVSS 3.1 · Published 2023-01-09

Mercurius is a GraphQL server library for Node.js that provides real-time subscriptions over WebSocket. An attacker can cause the service to crash by sending a malformed WebSocket packet to the GraphQL endpoint, resulting in an uncaught exception that terminates the application and causes denial of service.

Technologies: [mercurius (npm)](https://junglewise.ai/threats/technologies/mercurius). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-22477 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-22477 being exploited in the wild.

**How severe is CVE-2023-22477?** Low severity, with a CVSS score of 3.1, published 9 January 2023.

**Which products and versions are affected?** mercurius (npm) SEMVER:introduced=9.0.0,fixed=11.5.0.

**Is there a fix for CVE-2023-22477?** Yes. mercurius (npm): upgrade to 11.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-22477 attacked?** It is attacked over the network.

**Am I affected by CVE-2023-22477?** Check whether you run mercurius (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mercurius (npm): upgrade to 11.5.0 or later

  ```sh
  npm install mercurius@11.5.0
  ```


## Technical details

This vulnerability is caused by an uncaught exception (CWE-248) when processing malformed WebSocket packets sent to the /graphql subscription endpoint. The attack requires no authentication or user interaction and is triggered by sending a crafted packet over the network via WebSocket. Any user running Mercurius versions 9.0.0 through 11.4.x or versions prior to 8.13.2 is vulnerable to having their GraphQL service crash. The vulnerability was patched in v11.5.0 and v8.13.2, with the fix properly handling and validating incoming subscription packets to prevent exception propagation.

## Affected products

- Mercurius mercurius <8.13.2, >=9.0.0, <11.5.0

## Identifiers

- CVE-2023-22477
- GHSA-cm8h-q92v-xcfc

## Timeline

- 2023-01-09: disclosed: Vulnerability published publicly
- 2023-01-09: patched: Patched in v11.5.0 and v8.13.2

## References

- [https://github.com/mercurius-js/mercurius/security/advisories/GHSA-cm8h-q92v-xcfc](https://github.com/mercurius-js/mercurius/security/advisories/GHSA-cm8h-q92v-xcfc)

## Related threats

- [Mercurius queryDepth limit bypass in WebSocket subscriptions](https://junglewise.ai/threats/cve-2026-30241-mercurius-querydepth-limit-bypass-in-websocket-subscriptions)
- [Mercurius incorrect Content-Type parsing CSRF vulnerability](https://junglewise.ai/threats/cve-2025-64166-mercurius-incorrect-content-type-parsing-csrf-vulnerability)
- [mercurius-js mercurius denial of service via uncaught exception](https://junglewise.ai/threats/cve-2021-43801-mercurius-js-mercurius-denial-of-service-via-uncaught-exception)