Executive brief
Mercurius is a GraphQL server library for Node.js that enforces query depth limits to prevent denial-of-service attacks. A flaw allows attackers to bypass this depth validation when submitting queries over WebSocket subscription connections, while the protection works correctly for HTTP-based queries. An attacker can submit arbitrarily deep queries that could exhaust server resources and cause service outages.
Technical details
Mercurius implements a queryDepth limit validation mechanism intended to prevent excessively nested GraphQL queries from consuming excessive computational resources. However, the depth validation logic is not applied to subscription queries received over WebSocket connections, only to HTTP queries and mutations. An unauthenticated remote attacker can send a malicious WebSocket subscription message with arbitrary query depth to bypass this restriction. On GraphQL schemas containing recursive types, this can trigger exponential data resolution on each subscription event, leading to denial of service. The vulnerability is tracked as CVE-2026-30241 and was fixed in Mercurius version 16.8.0.
Affected products
- Mercurius Mercurius < 16.8.0
Timeline
- 2026-03-06: disclosed
- 2026-03-06: patched: Fixed in version 16.8.0