Mercurius GraphQL Fixes Critical WebSocket Query Depth Bypass (CVE-2026-30241)

CVE-2026-30241: Missing Query Depth Validation in Mercurius GraphQL Subscriptions

The Mercurius GraphQL adapter for Fastify recently addressed CVE-2026-30241, a logic vulnerability involving missing query depth validation. This flaw allows unauthenticated attackers to submit arbitrarily nested queries through WebSocket subscriptions, bypassing standard HTTP security checks.

Why This Matters

In many GraphQL implementations, security validations are often tightly coupled with the HTTP request-response lifecycle, inadvertently leaving alternative transport layers like WebSockets less protected. This vulnerability demonstrates that failing to synchronize security logic across all entry points—specifically missing queryDepth validation for subscriptions—allows attackers to bypass intended resource constraints. Consequently, what appears to be a secure configuration becomes a single point of failure, highlighting the need for protocol-agnostic validation frameworks in high-performance Node.js environments.

Key Insights

• CVE-2026-30241 published in 2026 reveals a logic flaw in Mercurius; the concept of depth validation prevents CPU exhaustion from recursive queries; Mercurius is used by Node.js developers.
• CVSS score of 2.7 assigned in 2026 reflects a low-complexity DoS risk; the concept of CWE-863 involves incorrect authorization of resource-intensive operations; Fastify applications utilize Mercurius for GraphQL.
• Commit 5b56f60 in 2026 introduced regression tests to verify the fix; the concept of defense-in-depth suggests using cost analysis alongside depth limits; npm is used by engineers to update mercurius to 16.8.0.

Working Examples

Configuration example to enforce query depth in Mercurius.

app.register(mercurius, { queryDepth: 10, ... })

Practical Applications

• Use Case: Fastify applications using Mercurius must enforce queryDepth to prevent memory exhaustion. Pitfall: Missing depth validation on WebSockets allows attackers to bypass HTTP-only security filters.
• Use Case: Node.js GraphQL servers can implement global rate limiting to mitigate unauthenticated DoS. Pitfall: Designing recursive schemas without limits allows legitimate-looking queries to trigger resource-heavy resolution.

References:

• https://dev.to/cverports/cve-2026-30241-cve-2026-30241-missing-query-depth-validation-in-mercurius-graphql-subscriptions-4bia