CVE-2021-43801: Improper Check for Unusual or Exceptional Conditions

December 13, 2021 (updated December 15, 2021)

Mercurius is a GraphQL adapter for Fastify. It is vulnerable to a denial of service attack by sending a malformed JSON to /graphql unless they are using a custom error handler. As a workaround users may use a custom error handler.

References

github.com/mercurius-js/mercurius/issues/677
github.com/mercurius-js/mercurius/pull/678/commits/732b2f895312da8deadd7b173dcd2d141d54b223
github.com/mercurius-js/mercurius/security/advisories/GHSA-273r-rm8g-7f3x
nvd.nist.gov/vuln/detail/CVE-2021-43801

Code Behaviors & Features

Detect and mitigate CVE-2021-43801 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →