CVE-2021-43801

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Mercurius is a GraphQL adapter for Fastify. Any users from Mercurius@8.10.0 to 8.11.1 are subjected to a denial of service attack by sending a malformed JSON to `/graphql` unless they are using a custom error handler. The vulnerability has been fixed in https://github.com/mercurius-js/mercurius/pull/678 and shipped as v8.11.2. As a workaround users may use a custom error handler.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-754

Affected software

VendorProductVersions
mercurius-jsmercurius>= 8.10.0, < 8.11.2

References

Timeline

Published
Dec 13, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-438028.8Etherpad is a real-time collaborative editor. In versions prior to 1.8.16, an attacker can craft an `*.etherpad` file that, when imported, mCVE-2021-438037.5Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In oCVE-2021-438047.3PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDCVE-2021-438057.5Solidus is a free, open-source ecommerce platform built on Rails. Versions of Solidus prior to 3.1.4, 3.0.4, and 2.11.13 have a denial of seCVE-2021-438068.8Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does CVE-2021-438076.5Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast versions prior to 9.10 allow HTTP method spoofing, allCVE-2021-438086.1Laravel is a web application framework. Laravel prior to versions 8.75.0, 7.30.6, and 6.20.42 contain a possible cross-site scripting (XSS) CVE-2021-438097.3`Bundler` is a package for managing application dependencies in Ruby. In `bundler` versions before 2.2.33, when working with untrusted and aCVE-2021-43819.8The uListing plugin for WordPress is vulnerable to authorization bypass via wp_route due to missing capability checks, and a missing securitCVE-2021-438106.1Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is preseCVE-2021-438117.8Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model aCVE-2021-438126.1The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out cer