CVE-2025-64166: Mercurius Incorrect Content-Type Parsing Leading to CSRF Vulnerability
Summary
CVE-2025-64166: Mercurius: Incorrect Content-Type parsing can lead to CSRF attack. Affects mercurius versions < 16.4.0. Fixed in 16.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Mercurius is a GraphQL adapter for Fastify, designed to facilitate the integration of GraphQL APIs into Fastify applications. It allows developers to define schemas and resolvers, enabling efficient data fetching and manipulation. However, a vulnerability was discovered in Mercurius versions prior to 16.4.0, which could lead to Cross-Site Request Forgery (CSRF) attacks due to improper handling of the Content-Type header in HTTP requests.
Vulnerability Detail
A Cross-Site Request Forgery (CSRF) vulnerability exists in Mercurius versions 16.3.0 and earlier. The issue stems from incorrect parsing of the Content-Type header, where certain types such as application/x-www-form-urlencoded, multipart/form-data, or text/plain are misinterpreted as application/json. This misinterpretation allows unauthorized actions to be executed on behalf of authenticated users, bypassing Cross-Origin Resource Sharing (CORS) protections.
How To Fix
Minimum fixed version
16.4.0
This is the first release that contains the fix.
npm install mercurius@16.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can implement additional CSRF protection mechanisms in your application. However, the most effective solution is to update to the patched version of Mercurius.
Conclusion
The CSRF vulnerability identified in Mercurius can have serious implications for applications using affected versions. It is crucial to update to version 16.4.0 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for mercurius →
FAQ
The vulnerability is a CSRF issue caused by incorrect parsing of the Content-Type header in Mercurius, allowing unauthorized actions to be performed.
Mercurius versions 16.3.0 and earlier are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
If immediate updating is not possible, consider implementing additional CSRF protection mechanisms as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for mercurius.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
