CVE-2025-64166 Mercurius: Incorrect Content-Type parsing can lead to CSRF attack
Incorrect Content-Type parsing in Mercurius allows CSRF attacks, enabling unauthorized actions on behalf of authenticated users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-64166?
CVE-2025-64166 is a medium-severity vulnerability in mercurius-js mercurius, published on 5 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Mercurius is a GraphQL adapter for Fastify. Prior to version 16.4.0, a cross-site request forgery (CSRF) vulnerability was identified. The issue arises from incorrect parsing of the Content-Type header in requests. Specifically, requests with Content-Type values such as application/x-www-form-urlencoded, multipart/form-data, or text/plain could be misinterpreted as application/json. This misinterpretation bypasses the preflight checks performed by the fetch() API, potentially allowing unauthorized actions to be performed on behalf of an authenticated user. This issue has been patched in version 16.4.0.
Weakness: CWE-352
Which versions are affected by CVE-2025-64166?
2 open source packages ship an affected version, including mercurius. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mercurius npm | All versions | 16.4.0 |
mercurius npm | All versions | 16.4.0 |
Products include Mercurius Project Mercurius.
How do I fix CVE-2025-64166?
Upgrade mercurius to 16.4.0 or later.
Is CVE-2025-64166 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-64166 exists.
Other vulnerabilities in mercurius-js mercurius
Sources
Also known as GHSA-v66j-6wwf-jc57.