CVE-2023-22477

Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to /graphql. This issue was patched in 940. As a workaround, users can disable subscriptions...

@didhubdev/core (>=0.0.11, <=0.0.39), @domedb/plugin-graphql (1.0.0) +14 more potentially affected by CVE-2023-22477 via mercurius (>=9.3.5, <=11.4.0)

mercurius NPM version =9.3.5, =0.0.11, =0.2.42, =2.37.0, =0.4.0, =0.6.0, =1.1.0, =0.0.24, =1.0.0, =1.0.1 and more Source cves: CVE-2023-22477 Source advisory: OSV:GHSA-CM8H-Q92V-XCFC...

CVE-2023-22477

Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to /graphql. This issue was patched in 940. As a workaround, users can disable subscriptions...

CVE-2023-22477

Summary: CVE-2023-22477 affects Mercurius (GraphQL adapter for Fastify) prior to v10.5.0. A malformed WebSocket packet sent to "/graphql" can cause a denial of service. The issue is documented in multiple sources and was patched in PR #940, with the fix released in v11.5.0 (and v8.13.2 in some br...

CVE-2023-22477 Mercurius is vulnerable to denial of service (DoS) when using subscriptions

Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to /graphql. This issue was patched in 940. As a workaround, users can disable subscriptions...