{"action":"Upgrade mercurius to 16.8.0 or later.","affected":[{"fixed":"16.8.0","introduced":"0"}],"component":"mercurius","cve_ids":["CVE-2026-30241"],"ecosystem":"npm","epss":0.00402,"exploited":false,"fixed_versions":["16.8.0"],"ghsa_id":"GHSA-m4h2-mjfm-mp55","id":"tcs_01M5KFZJ5QWH8MTVK0NXJ1BQMX","modified_at":"2026-03-09T13:16:31.467783Z","published_at":"2026-03-06T18:47:52Z","references":["https://osv.dev/vulnerability/GHSA-m4h2-mjfm-mp55","https://github.com/mercurius-js/mercurius/security/advisories/GHSA-m4h2-mjfm-mp55","https://nvd.nist.gov/vuln/detail/CVE-2026-30241","https://github.com/mercurius-js/mercurius/commit/5b56f60f4b0d60780b0ff499a479bd830bdd6986","https://github.com/mercurius-js/mercurius"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-m4h2-mjfm-mp55","url":"https://osv.dev/vulnerability/GHSA-m4h2-mjfm-mp55"},{"source":"nvd","source_id":"CVE-2026-30241","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30241"}],"summary":"Mercurius's queryDepth limit bypassed for WebSocket subscriptions"}