What is GHSA-cm8h-q92v-xcfc?

GHSA-cm8h-q92v-xcfc is a security advisory published by GitHub Security Advisories with Medium severity. mercurius has Uncaught Exception when using subscriptions

Which CVE IDs does GHSA-cm8h-q92v-xcfc cover?

GHSA-cm8h-q92v-xcfc covers the following CVE IDs: CVE-2023-22477. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cm8h-q92v-xcfc?

GHSA-cm8h-q92v-xcfc has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-cm8h-q92v-xcfc?

GHSA-cm8h-q92v-xcfc affects 2 products, including: npm/mercurius:\u003e= 9.0.0, \u003c 11.5.0; npm/mercurius:\u003c 8.13.2.

GHSA-cm8h-q92v-xcfcMediumCVSS 5.3

mercurius has Uncaught Exception when using subscriptions

Vendor

GitHub Security Advisories

Published

January 9, 2023

Last Modified

February 3, 2023

🔗 CVE IDs covered (1)

CVE-2023-22477 →

📋 Description

Impact

Any users of Mercurius until version v11.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to /graphql.

Patches

This was patched in https://github.com/mercurius-js/mercurius/pull/940. The patch was released as v11.5.0 and v8.13.2.

Workarounds

Disable subscriptions.

References

Reported publicly as https://github.com/mercurius-js/mercurius/issues/939. The same problem was solved in https://github.com/fastify/fastify-websocket/pull/228

🎯 Affected products2

npm/mercurius:>= 9.0.0, < 11.5.0
npm/mercurius:< 8.13.2

🔗 References (6)

https://github.com/mercurius-js/mercurius/security/advisories/GHSA-cm8h-q92v-xcfc
https://nvd.nist.gov/vuln/detail/CVE-2023-22477
https://github.com/mercurius-js/mercurius/issues/939
https://github.com/fastify/fastify-websocket/pull/228
https://github.com/mercurius-js/mercurius/pull/940
https://github.com/advisories/GHSA-cm8h-q92v-xcfc