CVE-2021-43801

Mercurius is a GraphQL adapter for Fastify. Any users from Mercurius@8.10.0 to 8.11.1 are subjected to a denial of service attack by sending a malformed JSON to `/graphql` unless they are using a custom error handler. The vulnerability has been fixed in https://github.com/mercurius-js/mercurius/pull/678 and shipped as v8.11.2. As a workaround users may use a custom error handler.

• CWE-754

• https://github.com/mercurius-js/mercurius/issues/677Issue Tracking, Patch, Third Party Advisory
• https://github.com/mercurius-js/mercurius/pull/678/commits/732b2f895312da8deadd7b173dcd2d141d54b223Patch, Third Party Advisory
• https://github.com/mercurius-js/mercurius/security/advisories/GHSA-273r-rm8g-7f3xPatch, Third Party Advisory
• https://github.com/mercurius-js/mercurius/issues/677Issue Tracking, Patch, Third Party Advisory
• https://github.com/mercurius-js/mercurius/pull/678/commits/732b2f895312da8deadd7b173dcd2d141d54b223Patch, Third Party Advisory
• https://github.com/mercurius-js/mercurius/security/advisories/GHSA-273r-rm8g-7f3xPatch, Third Party Advisory

Published

Dec 13, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43795Armeria is an open source microservice framework. In affecte…7.5
• CVE-2021-43797Netty is an asynchronous event-driven network application fr…6.5
• CVE-2021-43798Grafana is an open-source platform for monitoring and observ…7.5
• CVE-2021-43799Zulip is an open-source team collaboration tool. Zulip Serve…9.8
• CVE-2021-4380The Pinterest Automatic plugin for WordPress is vulnerable t…9.8
• CVE-2021-43800Wiki.js is a wiki app built on Node.js. Prior to version 2.5…7.5
• CVE-2021-43802Etherpad is a real-time collaborative editor. In versions pr…8.8
• CVE-2021-43803Next.js is a React framework. In versions of Next.js prior t…7.5
• CVE-2021-43804PJSIP is a free and open source multimedia communication lib…7.3
• CVE-2021-43805Solidus is a free, open-source ecommerce platform built on R…7.5
• CVE-2021-43806Tuleap is a Libre and Open Source tool for end to end tracea…8.8
• CVE-2021-43807Opencast is an Open Source Lecture Capture & Video Managemen…6.5