TI-2025-39610 Aliases CVE-2025-64166 GHSA-v66j-6wwf-jc57

Mercurius: Incorrect Content-Type parsing can lead to CSRF attack

MEDIUM 58CWE-352Published 2026-03-05 · Updated 2026-03-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Tampering
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

Mercurius is a GraphQL adapter for Fastify. Prior to version 16.4.0, a cross-site request forgery (CSRF) vulnerability was identified. The issue arises from incorrect parsing of the Content-Type header in requests. Specifically, requests with Content-Type values such as application/x-www-form-urlencoded, multipart/form-data, or text/plain could be misinterpreted as application/json. This misinterpretation bypasses the preflight checks performed by the fetch() API, potentially allowing unauthorized actions to be performed on behalf of an authenticated user. This issue has been patched in version 16.4.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00184 7th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed mercurius (mercurius-js): 16.4.0mercurius (npm): 16.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
mercurius-js	mercurius	before 16.4.0	16.4.0	Patch available	CNA
—	mercurius (npm)	before 16.4.0	16.4.0	Patch available	GHSA-v66j-6wwf-jc57

mercurius Vendormercurius-js Affected before 16.4.0 Fixed in 16.4.0 Patch available CNA
mercurius (npm) Vendor— Affected before 16.4.0 Fixed in 16.4.0 Patch available GHSA-v66j-6wwf-jc57

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:mercurius_project:mercurius::::::node.js::*	before 16.4.0	Vulnerable	mercurius-js

cpe:2.3:a:mercurius_project:mercurius:*:*:*:*:*:node.js:*:* Versions before 16.4.0 Vulnerable ·mercurius-js

Remediation

Fix · CNA mercurius (mercurius-js) Fixed in 16.4.0
Fix · GHSA-v66j-6wwf-jc57 mercurius (npm) Fixed in 16.4.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-64166
2026-10-03 Alias added: GHSA-v66j-6wwf-jc57

References

Exploit 1

https://github.com/mercurius-js/mercurius/security/advisories/GHSA-v66j-6wwf-jc57

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-64166

Other 1

https://github.com/mercurius-js/mercurius

TI-2023-08726 Mercurius is vulnerable to denial of service (DoS) when using subscriptions CVSS 3.1HIGH 7.5
TI-2021-19607 Uncaught Exception in mercurius CVSS 3.1HIGH 7.5
TI-2026-23474 Mercurius: queryDepth limit bypassed for WebSocket subscriptions CVSS 4.0LOW 2.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences