Mercurius is a GraphQL adapter for Fastify that enforces a queryDepth limit on client requests. Prior to version 16.8.0 the limit is applied to HTTP queries and mutations but is omitted for subscription queries received via WebSocket. An attacker can send a subscription with arbitrary nesting depth, causing the server to resolve deeply nested fields for every subscription event. This leads to a denial‑of‑service condition due to exponential data resolution when the schema contains recursive types.

The issue affects Mercurius version 16.7.x and earlier. Any deployment using the mercurius npm package via Node.js that serves GraphQL subscriptions over WebSocket is vulnerable until the vendor releases version 16.8.0.

The CVSS score is 2.7, indicating low severity, implying a very small likelihood of exploitation in the wild. The EPSS score is less than 1%, indicating a very low probability of exploitation in the wild. The flaw can be exploited remotely by any client that can establish a WebSocket connection to the GraphQL endpoint; the injection of deeply nested subscription queries is the likely attack vector. Since the vulnerability is limited to subscription operations on WebSocket, an attacker needs prior access to a WebSocket‑enabled GraphQL server.