Snyk Security Database

mercurius is a GraphQL adapter for Fastify

Affected versions of this package are vulnerable to Uncontrolled Recursion in the subscription queries received over WebSocket connections. An attacker can bypass intended query depth restrictions by submitting deeply nested subscription queries via WebSocket, potentially causing excessive resource consumption and service disruption.

fickling is an A static analyzer and interpreter for Python pickle data

Affected versions of this package are vulnerable to Improperly Implemented Security Check for Standard in the always_check_safety() function. An attacker can execute arbitrary code by supplying a malicious pickle payload to unprotected deserialization entry points.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the JwtAuthenticator component when handling encrypted JWTs. An attacker can gain unauthorized access by crafting a JWE-wrapped PlainJWT with arbitrary claims if they possess the server's RSA public key, thereby impersonating any user, including administrators.