https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T07:44:22.339877+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-221692 EUVD-2026-221692 2026-10-09T07:44:22.345755+00:00 EUVD-2026-221692 https://cve.radiocsirt.org/vuln/fkie_cve-2023-22477 fkie_cve-2023-22477 2026-10-09T07:44:22.345797+00:00

Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to `/graphql`. This issue was patched in #940. As a workaround, users can disable subscriptions.

 https://cve.radiocsirt.org/vuln/ghsa-cm8h-q92v-xcfc GHSA-cm8h-q92v-xcfc — mercurius has Uncaught Exception when using subscriptions 2026-10-09T07:44:22.345830+00:00

Affected: npm: mercurius

### Impact

Any users of Mercurius until version v11.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to `/graphql`.

### Patches

This was patched in https://github.com/mercurius-js/mercurius/pull/940. The patch was released as v11.5.0 and v8.13.2.

### Workarounds

Disable subscriptions.

### References

Reported publicly as https://github.com/mercurius-js/mercurius/issues/939. The same problem was solved in https://github.com/fastify/fastify-websocket/pull/228

 https://cve.radiocsirt.org/vuln/gsd-2023-22477 gsd-2023-22477 2026-10-09T07:44:22.345864+00:00 gsd-2023-22477