mercurius-js mercurius up to 16.3.x Content-Type Header fetch cross-site request forgery

Summaryinfo

A vulnerability marked as problematic has been reported in mercurius-js mercurius up to 16.3.x. The impacted element is the function fetch of the component Content-Type Header Handler. This manipulation of the argument Content-Type causes cross-site request forgery. This vulnerability appears as CVE-2025-64166. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in mercurius-js mercurius up to 16.3.x and classified as problematic. Affected by this vulnerability is the function fetch of the component Content-Type Header Handler. The manipulation of the argument Content-Type with an unknown input leads to a cross-site request forgery vulnerability. The CWE definition for the vulnerability is CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. As an impact it is known to affect integrity. The summary by CVE is:

Mercurius is a GraphQL adapter for Fastify. Prior to version 16.4.0, a cross-site request forgery (CSRF) vulnerability was identified. The issue arises from incorrect parsing of the Content-Type header in requests. Specifically, requests with Content-Type values such as application/x-www-form-urlencoded, multipart/form-data, or text/plain could be misinterpreted as application/json. This misinterpretation bypasses the preflight checks performed by the fetch() API, potentially allowing unauthorized actions to be performed on behalf of an authenticated user. This issue has been patched in version 16.4.0.

The advisory is shared at github.com. This vulnerability is known as CVE-2025-64166 since 10/28/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 16.4.0 eliminates this vulnerability. Applying the patch 962d402ec7a92342f4a1b7f5f04af01776838c3c is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• mercurius-js

Name

• mercurius

Version

• 16.0
• 16.1
• 16.2
• 16.3

License

• open-source

Website

• Product: https://github.com/mercurius-js/mercurius/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion