CVE-2026-30241
Received Received - Intake
Subscription Query Depth Bypass in Mercurius Causes DoS

Publication date: 2026-03-06

Last updated on: 2026-03-12

Assigner: GitHub, Inc.

Description
Mercurius is a GraphQL adapter for Fastify. Prior to version 16.8.0, Mercurius fails to enforce the configured queryDepth limit on GraphQL subscription queries received over WebSocket connections. The depth check is correctly applied to HTTP queries and mutations, but subscription queries are parsed and executed without invoking the depth validation. This allows a remote client to submit arbitrarily deeply nested subscription queries over WebSocket, bypassing the intended depth restriction. On schemas with recursive types, this can lead to denial of service through exponential data resolution on each subscription event. This issue has been patched in version 16.8.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-06
Last Modified
2026-03-12
Generated
2026-06-16
AI Q&A
2026-03-07
EPSS Evaluated
2026-06-15
NVD
CVE-2026-30241
EUVD
EUVD-2026-10081
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
mercurius_project mercurius to 16.8.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in Mercurius, a GraphQL adapter for Fastify, in versions prior to 16.8.0. Mercurius fails to enforce the configured queryDepth limit on GraphQL subscription queries received over WebSocket connections. While the depth limit is correctly applied to HTTP queries and mutations, subscription queries bypass this check when sent over WebSocket. This allows a remote client to submit subscription queries with arbitrarily deep nesting, ignoring the intended depth restrictions.

On schemas that include recursive types, this can cause a denial of service (DoS) because each subscription event triggers exponential data resolution, overwhelming the system.

This issue was fixed in Mercurius version 16.8.0.

Impact Analysis

The primary impact of this vulnerability is the potential for denial of service (DoS) attacks. An attacker can send deeply nested subscription queries over WebSocket connections that bypass the depth limit, causing the server to perform excessive and exponential data resolution.

This can degrade the performance of the affected system, potentially making it unavailable to legitimate users.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, upgrade Mercurius to version 16.8.0 or later, where the issue has been patched.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-30241. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart