CVE-2021-43801

    Dashboard / Vulnerabilities / CVE-2021-43801

    CVE-2021-43801

    Published: 13 Dec 2021Last Modified: 9 Jul 2026

    Summary:

    Details: Mercurius is a GraphQL adapter for Fastify. Any users from [email protected] to 8.11.1 are subjected to a denial of service attack by sending a malformed JSON to `/graphql` unless they are using a custom error handler. The vulnerability has been fixed in https://github.com/mercurius-js/mercurius/pull/678 and shipped as v8.11.2. As a workaround users may use a custom error handler.

    References: https://github.com/mercurius-js/mercurius/issues/677, https://github.com/mercurius-js/mercurius/pull/678/commits/732b2f895312da8deadd7b173dcd2d141d54b223, https://github.com/mercurius-js/mercurius/security/advisories/GHSA-273r-rm8g-7f3x

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 3b861dd8c35c09568b65d8293e4206bba9a23213
    Fixed -d34a103fd9fe3df941acdd6072c6a602d235fcbb

    Affected versions

    v8.11.1
    v8.11.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-43801 | CVE-DB