CVE-2021-43801: Improper Check for Unusual or Exceptional Conditions

December 13, 2021 (updated December 15, 2021)

Mercurius is a GraphQL adapter for Fastify. It is vulnerable to a denial of service attack by sending a malformed JSON to /graphql unless they are using a custom error handler. As a workaround users may use a custom error handler.

References

github.com/mercurius-js/mercurius/issues/677
github.com/mercurius-js/mercurius/pull/678/commits/732b2f895312da8deadd7b173dcd2d141d54b223
github.com/mercurius-js/mercurius/security/advisories/GHSA-273r-rm8g-7f3x
nvd.nist.gov/vuln/detail/CVE-2021-43801

Detect and mitigate CVE-2021-43801 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →