# CVE-2026-30241: Mercurius queryDepth limit bypass in WebSocket subscriptions

Source: https://junglewise.ai/threats/cve-2026-30241-mercurius-querydepth-limit-bypass-in-websocket-subscriptions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-30241 · Severity: medium · CVSS 4 · Published 2026-03-06

Mercurius is a GraphQL server library for Node.js that enforces query depth limits to prevent denial-of-service attacks. A flaw allows attackers to bypass this depth validation when submitting queries over WebSocket subscription connections, while the protection works correctly for HTTP-based queries. An attacker can submit arbitrarily deep queries that could exhaust server resources and cause service outages.

Technologies: [mercurius (npm)](https://junglewise.ai/threats/technologies/mercurius). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-30241 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-30241 being exploited in the wild.

**How severe is CVE-2026-30241?** Medium severity, with a CVSS score of 4, published 6 March 2026.

**Which products and versions are affected?** mercurius (npm) SEMVER:introduced=0,fixed=16.8.0.

**Is there a fix for CVE-2026-30241?** Yes. mercurius (npm): upgrade to 16.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-30241 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-30241?** Check whether you run mercurius (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mercurius (npm): upgrade to 16.8.0 or later

  ```sh
  npm install mercurius@16.8.0
  ```


## Technical details

Mercurius implements a queryDepth limit validation mechanism intended to prevent excessively nested GraphQL queries from consuming excessive computational resources. However, the depth validation logic is not applied to subscription queries received over WebSocket connections, only to HTTP queries and mutations. An unauthenticated remote attacker can send a malicious WebSocket subscription message with arbitrary query depth to bypass this restriction. On GraphQL schemas containing recursive types, this can trigger exponential data resolution on each subscription event, leading to denial of service. The vulnerability is tracked as CVE-2026-30241 and was fixed in Mercurius version 16.8.0.

## Affected products

- Mercurius Mercurius < 16.8.0

## Identifiers

- CVE-2026-30241
- GHSA-m4h2-mjfm-mp55

## Timeline

- 2026-03-06: disclosed
- 2026-03-06: patched: Fixed in version 16.8.0

## References

- [https://github.com/mercurius-js/mercurius/security/advisories/GHSA-m4h2-mjfm-mp55](https://github.com/mercurius-js/mercurius/security/advisories/GHSA-m4h2-mjfm-mp55)

## Related threats

- [Mercurius incorrect Content-Type parsing CSRF vulnerability](https://junglewise.ai/threats/cve-2025-64166-mercurius-incorrect-content-type-parsing-csrf-vulnerability)
- [mercurius uncaught exception in subscriptions](https://junglewise.ai/threats/cve-2023-22477-mercurius-uncaught-exception-in-subscriptions)
- [mercurius-js mercurius denial of service via uncaught exception](https://junglewise.ai/threats/cve-2021-43801-mercurius-js-mercurius-denial-of-service-via-uncaught-exception)