PT-2026-23759 · Mercurius · Mercurius

Tinkanet · Published 2026-03-06 · Updated 2026-03-12 · CVE-2026-30241

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Mercurius versions prior to 16.8.0

Description Mercurius does not properly enforce the configured queryDepth limit on GraphQL subscription queries received over WebSocket connections. The depth check functions as expected for HTTP queries and mutations, but subscription queries bypass this validation. This allows a remote client to send excessively nested subscription queries via WebSocket, circumventing the intended depth restriction. In schemas containing recursive types, this can result in a denial of service due to exponential data resolution with each subscription event.

Recommendations Update to version 16.8.0 or later. Disable subscriptions and queries over WebSocket.

Exploit

Fix

DoS

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-30241

GHSA-M4H2-MJFM-MP55

Affected Products

Mercurius

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30241.json · Exploit
• https://github.com/mercurius-js/mercurius/commit/5b56f60f4b0d60780b0ff499a479bd830bdd6986 · Patch
• https://github.com/mercurius-js/mercurius/security/advisories/GHSA-m4h2-mjfm-mp55 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30241 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m4h2-mjfm-mp55 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30241 · Security Note
• https://github.com/mercurius-js/mercurius · Note
• https://t.me/CVEtracker/46663 · Telegram Post
• https://t.me/cveNotify/155297 · Telegram Post
• https://twitter.com/CVEnew/status/2030385150610042893 · Twitter Post