CVE-2025-64166

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-64166", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-10-28T21:07:16.438Z", "datePublished": "2026-03-05T15:31:45.641Z", "dateUpdated": "2026-03-05T16:34:35.585Z"}, "containers": {"cna": {"title": "Mercurius: Incorrect Content-Type parsing can lead to CSRF attack", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/mercurius-js/mercurius/security/advisories/GHSA-v66j-6wwf-jc57", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mercurius-js/mercurius/security/advisories/GHSA-v66j-6wwf-jc57"}, {"name": "https://github.com/mercurius-js/mercurius/pull/1187", "tags": ["x_refsource_MISC"], "url": "https://github.com/mercurius-js/mercurius/pull/1187"}, {"name": "https://github.com/mercurius-js/mercurius/commit/962d402ec7a92342f4a1b7f5f04af01776838c3c", "tags": ["x_refsource_MISC"], "url": "https://github.com/mercurius-js/mercurius/commit/962d402ec7a92342f4a1b7f5f04af01776838c3c"}], "affected": [{"vendor": "mercurius-js", "product": "mercurius", "versions": [{"version": "< 16.4.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-05T15:31:45.641Z"}, "descriptions": [{"lang": "en", "value": "Mercurius is a GraphQL adapter for Fastify. Prior to version 16.4.0, a cross-site request forgery (CSRF) vulnerability was identified. The issue arises from incorrect parsing of the Content-Type header in requests. Specifically, requests with Content-Type values such as application/x-www-form-urlencoded, multipart/form-data, or text/plain could be misinterpreted as application/json. This misinterpretation bypasses the preflight checks performed by the fetch() API, potentially allowing unauthorized actions to be performed on behalf of an authenticated user. This issue has been patched in version 16.4.0."}], "source": {"advisory": "GHSA-v66j-6wwf-jc57", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/mercurius-js/mercurius/security/advisories/GHSA-v66j-6wwf-jc57", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-05T16:34:32.783675Z", "id": "CVE-2025-64166", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T16:34:35.585Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-64166", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-05T16:34:32.783675Z"}}}], "references": [{"url": "https://github.com/mercurius-js/mercurius/security/advisories/GHSA-v66j-6wwf-jc57", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T16:34:28.593Z"}}], "cna": {"title": "Mercurius: Incorrect Content-Type parsing can lead to CSRF attack", "source": {"advisory": "GHSA-v66j-6wwf-jc57", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "mercurius-js", "product": "mercurius", "versions": [{"status": "affected", "version": "< 16.4.0"}]}], "references": [{"url": "https://github.com/mercurius-js/mercurius/security/advisories/GHSA-v66j-6wwf-jc57", "name": "https://github.com/mercurius-js/mercurius/security/advisories/GHSA-v66j-6wwf-jc57", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/mercurius-js/mercurius/pull/1187", "name": "https://github.com/mercurius-js/mercurius/pull/1187", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mercurius-js/mercurius/commit/962d402ec7a92342f4a1b7f5f04af01776838c3c", "name": "https://github.com/mercurius-js/mercurius/commit/962d402ec7a92342f4a1b7f5f04af01776838c3c", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Mercurius is a GraphQL adapter for Fastify. Prior to version 16.4.0, a cross-site request forgery (CSRF) vulnerability was identified. The issue arises from incorrect parsing of the Content-Type header in requests. Specifically, requests with Content-Type values such as application/x-www-form-urlencoded, multipart/form-data, or text/plain could be misinterpreted as application/json. This misinterpretation bypasses the preflight checks performed by the fetch() API, potentially allowing unauthorized actions to be performed on behalf of an authenticated user. This issue has been patched in version 16.4.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-05T15:31:45.641Z"}}}, "cveMetadata": {"cveId": "CVE-2025-64166", "state": "PUBLISHED", "dateUpdated": "2026-03-05T16:34:35.585Z", "dateReserved": "2025-10-28T21:07:16.438Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-05T15:31:45.641Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mercurius", "vendor": "mercurius-js", "versions": [{"status": "affected", "version": "< 16.4.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mercurius_project:mercurius:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "A2B6A965-0F41-453F-8A1B-5D5C2709BB0E", "versionEndExcluding": "16.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mercurius is a GraphQL adapter for Fastify. Prior to version 16.4.0, a cross-site request forgery (CSRF) vulnerability was identified. The issue arises from incorrect parsing of the Content-Type header in requests. Specifically, requests with Content-Type values such as application/x-www-form-urlencoded, multipart/form-data, or text/plain could be misinterpreted as application/json. This misinterpretation bypasses the preflight checks performed by the fetch() API, potentially allowing unauthorized actions to be performed on behalf of an authenticated user. This issue has been patched in version 16.4.0."}, {"lang": "es", "value": "Mercurius es un adaptador GraphQL para Fastify. Antes de la versi\u00f3n 16.4.0, se identific\u00f3 una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF). El problema surge del an\u00e1lisis incorrecto del encabezado Content-Type en las peticiones. Espec\u00edficamente, las peticiones con valores de Content-Type como application/x-www-form-urlencoded, multipart/form-data o text/plain podr\u00edan ser malinterpretadas como application/json. Esta mala interpretaci\u00f3n omite las comprobaciones previas realizadas por la API fetch(), lo que podr\u00eda permitir que se realicen acciones no autorizadas en nombre de un usuario autenticado. Este problema ha sido parcheado en la versi\u00f3n 16.4.0."}], "id": "CVE-2025-64166", "lastModified": "2026-06-17T09:53:56.630", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64166", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-05T16:34:32.783675Z", "version": "2.0.3"}}]}, "published": "2026-03-05T16:16:11.310", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/mercurius-js/mercurius/commit/962d402ec7a92342f4a1b7f5f04af01776838c3c"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/mercurius-js/mercurius/pull/1187"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/mercurius-js/mercurius/security/advisories/GHSA-v66j-6wwf-jc57"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/mercurius-js/mercurius/security/advisories/GHSA-v66j-6wwf-jc57"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,16.4.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "mercurius", "vendor": "mercurius-js"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,16.4.0)"}}], "product": "mercurius", "vendor": "mercurius_project"}], "created": "2026-03-06T15:01:48.028741+00:00", "updated": "2026-03-06T15:01:48.028832+00:00", "vendors": ["mercurius-js", "mercurius-js$PRODUCT$mercurius", "mercurius_project", "mercurius_project$PRODUCT$mercurius"]}