CVE-2026-30241
1 advisory.
npm/mercurius CVE-2026-30241: low
Mercurius's queryDepth limit bypassed for WebSocket subscriptions
Action: Upgrade mercurius to 16.8.0 or later.
npm i mercurius@16.8.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 16.8.0 | - |
Fixed versions
| 16.8.0 |
Sources
- osv: GHSA-m4h2-mjfm-mp55
- https://github.com/mercurius-js/mercurius/security/advisories/GHSA-m4h2-mjfm-mp55
- https://nvd.nist.gov/vuln/detail/CVE-2026-30241
- https://github.com/mercurius-js/mercurius/commit/5b56f60f4b0d60780b0ff499a479bd830bdd6986
- https://github.com/mercurius-js/mercurius
CVE-2026-30241 · published · modified · JSON