CVE-2025-64166
Description
Mercurius is a GraphQL adapter for Fastify. Prior to version 16.4.0, a cross-site request forgery (CSRF) vulnerability was identified. The issue arises from incorrect parsing of the Content-Type header in requests. Specifically, requests with Content-Type values such as application/x-www-form-urlencoded, multipart/form-data, or text/plain could be misinterpreted as application/json. This misinterpretation bypasses the preflight checks performed by the fetch() API, potentially allowing unauthorized actions to be performed on behalf of an authenticated user. This issue has been patched in version 16.4.0.
How to fix
- mercurius_project mercurius16.4.0 or later
- mercurius16.4.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mercurius_project mercurius | v < 16.4.0 | 16.4.0 |
| mercuriusnpm | v < 16.4.0 | 16.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.