CVE-2021-43801 Uncaught Exception in mercurius
Attackers can cause denial of service in Mercurius GraphQL adapter by sending malformed JSON, unless a custom error handler is configured.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-43801?
CVE-2021-43801 is a high-severity denial of service vulnerability in mercurius-js mercurius, published on 13 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mercurius is a GraphQL adapter for Fastify. Any users from [email protected] to 8.11.1 are subjected to a denial of service attack by sending a malformed JSON to `/graphql` unless they are using a custom error handler. The vulnerability has been fixed in https://github.com/mercurius-js/mercurius/pull/678 and shipped as v8.11.2. As a workaround users may use a custom error handler.
Weakness: CWE-754
Which versions are affected by CVE-2021-43801?
2 open source packages ship an affected version, including mercurius. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mercurius npm | From 8.10.0 | 8.11.2 |
mercurius npm | From 8.10.0 | 8.11.2 |
Products include Mercurius Project Mercurius.
How do I fix CVE-2021-43801?
Upgrade mercurius to 8.11.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-43801 being exploited?
There is no known exploitation of CVE-2021-43801 in the wild and no public exploit code.
Other vulnerabilities in mercurius-js mercurius
Sources
Also known as GHSA-273r-rm8g-7f3x.