PT-2021-23943 · Mercurius+1 · Mercurius+1

Mcollina + 1 · Published 2021-12-13 · Updated 2021-12-15 · CVE-2021-43801

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Mercurius versions 8.10.0 through 8.11.1

Description: The issue affects Mercurius, a GraphQL adapter for Fastify, where users can be subjected to a denial of service attack by sending a malformed JSON to the /graphql API endpoint, unless they are using a custom error handler.

Recommendations: For versions 8.10.0 through 8.11.1, update to version 8.11.2 to resolve the issue. As a temporary workaround for versions 8.10.0 through 8.11.1, consider using a custom error handler to mitigate the risk of exploitation.

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2021-43801

GHSA-273R-RM8G-7F3X

Affected Products

Fastify

Mercurius

References · 8

• https://github.com/mercurius-js/mercurius/pull/678/commits/732b2f895312da8deadd7b173dcd2d141d54b223 · Patch
• https://github.com/mercurius-js/mercurius/issues/677 · Patch
• https://github.com/mercurius-js/mercurius/security/advisories/GHSA-273r-rm8g-7f3x · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-43801 · Security Note
• https://osv.dev/vulnerability/GHSA-273r-rm8g-7f3x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-43801 · Vendor Advisory
• https://github.com/mercurius-js/mercurius · Note
• https://t.me/cibsecurity/33886 · Telegram Post