Is CVE-2026-30241 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-30241 being exploited in the wild.

How severe is CVE-2026-30241?

Medium severity, with a CVSS score of 4, published 6 March 2026.

Which products and versions are affected?

mercurius (npm) SEMVER:introduced=0,fixed=16.8.0.

Is there a fix for CVE-2026-30241?

Yes. mercurius (npm): upgrade to 16.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-30241 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-30241?

Check whether you run mercurius (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-30241: Mercurius queryDepth limit bypass in WebSocket subscriptions

CVE-2026-30241 · Severity: medium · CVSS 4 · Published 2026-03-06

Mercurius is a GraphQL server library for Node.js that enforces query depth limits to prevent denial-of-service attacks. A flaw allows attackers to bypass this depth validation when submitting queries over WebSocket subscription connections, while the protection works correctly for HTTP-based queries. An attacker can submit arbitrarily deep queries that could exhaust server resources and cause service outages.

Technologies: mercurius (npm). Vendors: npm.

Quick answers

Is CVE-2026-30241 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-30241 being exploited in the wild.
How severe is CVE-2026-30241?: Medium severity, with a CVSS score of 4, published 6 March 2026.
Which products and versions are affected?: mercurius (npm) SEMVER:introduced=0,fixed=16.8.0.
Is there a fix for CVE-2026-30241?: Yes. mercurius (npm): upgrade to 16.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-30241 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-30241?: Check whether you run mercurius (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mercurius (npm): upgrade to 16.8.0 or later
```
npm install mercurius@16.8.0
```

Technical details

Mercurius implements a queryDepth limit validation mechanism intended to prevent excessively nested GraphQL queries from consuming excessive computational resources. However, the depth validation logic is not applied to subscription queries received over WebSocket connections, only to HTTP queries and mutations. An unauthenticated remote attacker can send a malicious WebSocket subscription message with arbitrary query depth to bypass this restriction. On GraphQL schemas containing recursive types, this can trigger exponential data resolution on each subscription event, leading to denial of service. The vulnerability is tracked as CVE-2026-30241 and was fixed in Mercurius version 16.8.0.

Affected products

Mercurius Mercurius < 16.8.0

Identifiers

CVE-2026-30241
GHSA-m4h2-mjfm-mp55

Timeline

2026-03-06: disclosed
2026-03-06: patched: Fixed in version 16.8.0

References

https://github.com/mercurius-js/mercurius/security/advisories/GHSA-m4h2-mjfm-mp55

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.