CVE-2026-30241

Mercurius is a GraphQL adapter for Fastify. Prior to version 16.8.0, Mercurius fails to enforce the configured queryDepth limit on GraphQL subscription queries received over WebSocket connections. The depth check is correctly applied to HTTP queries and mutations, but subscription queries are parsed and executed without invoking the depth validation. This allows a remote client to submit arbitrarily deeply nested subscription queries over WebSocket, bypassing the intended depth restriction. On schemas with recursive types, this can lead to denial of service through exponential data resolution on each subscription event. This issue has been patched in version 16.8.0.

• CWE-863

• https://github.com/mercurius-js/mercurius/commit/5b56f60f4b0d60780b0ff499a479bd830bdd6986Patch
• https://github.com/mercurius-js/mercurius/security/advisories/GHSA-m4h2-mjfm-mp55Vendor Advisory

Published

Mar 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30236OpenProject is an open-source, web-based project management …4.3
• CVE-2026-30237Group-Office is an enterprise customer relationship manageme…6.1
• CVE-2026-30238Group-Office is an enterprise customer relationship manageme…6.1
• CVE-2026-30239OpenProject is an open-source, web-based project management …7.1
• CVE-2026-3024Stored Cross-Site Scripting (XSS) vulnerability in the Wakym…5.4
• CVE-2026-30240Budibase is a low code platform for creating internal tools,…8.1
• CVE-2026-30242Plane is an an open-source project management tool. Prior to…8.5
• CVE-2026-30244Plane is an an open-source project management tool. Prior to…7.5
• CVE-2026-30246Fiber is a web framework for Go. In github.com/gofiber/fiber…6.5
• CVE-2026-30247WeKnora is an LLM-powered framework designed for deep docume…7.5
• CVE-2026-3025A flaw has been found in ShuoRen Smart Heating Integrated Ma…9.8
• CVE-2026-30251A reflected cross-site scripting (XSS) vulnerability in the …6.1