CVE-2026-30241: 
JavaScript vulnerability analysis and mitigation

CVE-2026-30241 is a query depth limit bypass vulnerability in the Mercurius GraphQL server for Node.js, where the configured queryDepth restriction is not enforced on GraphQL subscription queries received over WebSocket connections. All versions of the mercurius npm package prior to 16.8.0 are affected. The vulnerability was published on March 6, 2026, by maintainer mcollina, with credit to reporter TinkAnet (GitHub Advisory). It carries a CVSS v3.1 base score of 8.2 (High) and a CVSS v4.0 base score of 2.7 (Low), reflecting differing scoring methodologies (GitHub Advisory).

The root cause is classified as CWE-863 (Incorrect Authorization): the queryDepth validation logic is correctly invoked for HTTP-based GraphQL queries and mutations, but the code path handling WebSocket subscription connections in lib/subscription-connection.js did not call the depth-checking function before parsing and executing the subscription query (GitHub Security Advisory). The fix, applied in commit 5b56f60, threads the queryDepthLimit parameter through the subscription connection handler and invokes queryDepth(document.definitions, this.queryDepthLimit) before subscription execution, returning a MER_ERR_GQL_VALIDATION error if the limit is exceeded (Patch Commit). No authentication or special privileges are required; any remote client capable of opening a WebSocket connection to the GraphQL endpoint can submit arbitrarily nested subscription queries.

On schemas that define recursive types (e.g., a Human with a Dog pet, and a Dog with a Human owner), a deeply nested subscription query triggers exponential data resolution on every subscription event, potentially exhausting server CPU and memory and causing denial of service (GitHub Security Advisory). There is no confidentiality impact, and integrity impact is assessed as low (unauthorized modification of query processing behavior). The primary risk is availability degradation or complete service outage for applications relying on Mercurius subscriptions (GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.013% (6th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only the ability to establish a WebSocket connection to the target's GraphQL endpoint, with no authentication needed, making it trivially accessible to any remote attacker if subscriptions are enabled.

1. Reconnaissance: Identify a target application using the Mercurius GraphQL server (npm package mercurius < 16.8.0) with WebSocket subscriptions enabled. This can be done by inspecting package.json files in public repositories or probing the /graphql endpoint for WebSocket upgrade support.
2. Establish WebSocket connection: Connect to the target's GraphQL WebSocket endpoint (e.g., ws://target/graphql) using the graphql-ws subprotocol: new WebSocket('ws://target/graphql', 'graphql-ws').
3. Perform connection handshake: Send a connection_init message and wait for connection_ack to confirm the WebSocket session is established.
4. Craft deeply nested subscription query: Construct a subscription query that exploits recursive schema types to exceed the configured queryDepth limit, for example:

subscription {
  dogUpdated {
    owner { pet { owner { pet { owner { pet { name } } } } } }
  }
}

5. Send the malicious subscription: Transmit the nested subscription query as a start message over the WebSocket. Because depth validation is not applied, the server accepts and begins resolving the query.
6. Trigger denial of service: On each subscription event published to the topic, the server performs exponential data resolution across the deeply nested recursive fields, consuming excessive CPU and memory and degrading or crashing the service (GitHub Security Advisory, Patch Commit).

• Network: Unusual or high-volume WebSocket connections to the /graphql endpoint from unexpected source IPs; WebSocket sessions that remain open for extended periods while sending start-type subscription messages with deeply nested query payloads.
• Logs: Application logs showing GraphQL subscription queries with abnormally high nesting depth accepted without validation errors (prior to patching); server-side errors or OOM (out-of-memory) crashes correlated with subscription event processing.
• Process: Node.js process exhibiting sustained high CPU usage or memory growth during periods of low legitimate traffic; process crashes or restarts triggered by subscription event resolution.
• Application: Absence of MER_ERR_GQL_VALIDATION errors in logs for deeply nested subscription queries on unpatched versions, which would be present on patched versions (>= 16.8.0) (Patch Commit).

Upgrade the mercurius npm package to version 16.8.0 or later, which applies depth validation to WebSocket subscription queries (GitHub Security Advisory). For organizations unable to patch immediately, the recommended workaround is to disable WebSocket subscriptions entirely in the Mercurius configuration. Additional interim controls include implementing network-level restrictions to limit WebSocket access to trusted clients, and monitoring for unusually complex or deeply nested subscription queries (GitHub Advisory).

The vulnerability was disclosed by Mercurius maintainer mcollina via a GitHub Security Advisory on March 6, 2026, with a patch released simultaneously (GitHub Security Advisory). Coverage was picked up by automated vulnerability tracking services and security blogs shortly after disclosure, including posts on dev.to and infinitsec.net. No significant independent researcher commentary or major media coverage has been identified beyond routine vulnerability database aggregation.