AIKIDO-2026-381421
github.com/dunglas/mercure is vulnerable to Allocation of Resources Without Limits or Throttling
75
High Risk
This Affects:
github.com/dunglas/mercureTL;DR
The hub's topic matcher cache tracks compiled URL patterns by entry count rather than by the memory each pattern and topic string actually retains. A subscriber who requests many large or complex topic templates can grow the cache to gigabytes of retained memory on the hub process. The fix weighs each cache entry by its retained bytes and evicts by that weight instead of by count.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
github.com/dunglas/mercure is vulnerable to Allocation of Resources Without Limits or Throttling in versions 1.0.0 - 1.0.1.
How to fix this
Upgrade the github.com/dunglas/mercure library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.