CVE-2026-30241: Mercurius Mercurius's QueryDepth Limit Bypassed For Vulnerability

LOW
Advisory Identifier: GHSA-m4h2-mjfm-mp55
Share
CWE-863
Published
Advisory Summary

CVE-2026-30241 is a LOW mercurius's querydepth limit bypassed for vulnerability (CWE-863: Incorrect Authorization) affecting Mercurius libraries in the npm ecosystem. The issue involves mercurius's querydepth limit bypassed for websocket subscriptions. Remediation is available by upgrading affected packages to version 16.8.0.

CVE-2026-30241 at a Glance

CVE Identifier CVE-2026-30241
GHSA Identifier GHSA-m4h2-mjfm-mp55
Severity LOW
CVSS v3.1 Base Score N/A
CWE Classification CWE-863: Incorrect Authorization
Affected Product Mercurius
Package Ecosystem npm
Published Date
Last Updated

How to Fix CVE-2026-30241

To remediate this vulnerability, upgrade all affected Mercurius dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

mercurius fixed: 16.8.0 
npm install mercurius@16.8.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls mercurius

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2026-30241, inspect your project dependencies using npm:

npm ls mercurius

Analyze the terminal output to locate any version of Mercurius in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 16.8.0), your application is affected.

Note: The npm ls mercurius command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-863: Incorrect Authorization, where the product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. In Mercurius, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

## Description Mercurius fails to enforce the configured queryDepth limit on GraphQL subscription queries received over WebSocket connections. The depth check is correctly applied to HTTP queries and mutations, but subscription queries are parsed and executed without invoking the depth validation. This allows a remote client to submit arbitrarily deeply nested subscription queries over WebSocket, bypassing the intended depth restriction. On schemas with recursive types, this can lead to denial of service through exponential data resolution on each subscription event. ## Workarounds Disable subscriptions and, in general, queries over the WebSocket.

CVE-2026-30241 Affected Mercurius Versions

1 component(s)
Fixed Versions:
16.8.0
Product / Package Ecosystem Affected Versions Fixed Version
mercurius
npm/mercurius
npm
< 16.8.0
16.8.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/mercurius-js/mercurius/security/advisories/GHSA-m4h2-mjfm-mp55
NVD — CVE-2026-30241 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-30241
Security Fix Commit FIX COMMIT
https://github.com/mercurius-js/mercurius/commit/5b56f60f4b0d60780b0ff499a479bd830bdd6986
Mercurius Source Repository REPOSITORY
https://github.com/mercurius-js/mercurius

Frequently Asked Questions

What is CVE-2026-30241?
CVE-2026-30241 is a security vulnerability in Mercurius involving Mercurius's queryDepth limit bypassed for WebSocket subscriptions under CWE-863: Incorrect Authorization.
Which Mercurius versions are affected?
Affected versions include releases prior to 16.8.0 across affected packages: mercurius.
What version fixes CVE-2026-30241?
Upgrading to 16.8.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is mercurius affected?
Yes, mercurius is affected in releases prior to 16.8.0. Upgrade your dependency to 16.8.0 or later.
What CWE is associated with CVE-2026-30241?
CVE-2026-30241 is classified under CWE-863: Incorrect Authorization (The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.).
How can I check npm dependencies for CVE-2026-30241?
Run the dependency tree command: 'npm ls mercurius'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-m4h2-mjfm-mp55",
  "modified" : "2026-03-09T13:12:23Z",
  "published" : "2026-03-06T18:47:52Z",
  "aliases" : [ "CVE-2026-30241" ],
  "summary" : "Mercurius's queryDepth limit bypassed for WebSocket subscriptions",
  "details" : "## Description\n\nMercurius fails to enforce the configured queryDepth limit on GraphQL subscription queries received over WebSocket connections. The depth check is correctly applied to HTTP queries and mutations, but subscription queries are parsed and executed without invoking the depth validation. This allows a remote client to submit arbitrarily deeply nested subscription queries over WebSocket, bypassing the intended depth restriction. On schemas with recursive types, this can lead to denial of service through exponential data resolution on each subscription event.\n\n## Workarounds\n\nDisable subscriptions and, in general, queries over the WebSocket.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "mercurius"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "16.8.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/mercurius-js/mercurius/security/advisories/GHSA-m4h2-mjfm-mp55"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-30241"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/mercurius-js/mercurius/commit/5b56f60f4b0d60780b0ff499a479bd830bdd6986"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/mercurius-js/mercurius"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-863" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-06T18:47:52Z",
    "nvd_published_at" : "2026-03-06T22:16:01Z"
  }
}