Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Mercurius is a GraphQL adapter for Fastify. Prior to version 16.4.0, a cross-site request forgery (CSRF) vulnerability was identified. The issue arises from incorrect parsing of the Content-Type header in requests. Specifically, requests with Content-Type values such as application/x-www-form-urlencoded, multipart/form-data, or text/plain could be misinterpreted as application/json. This misinterpretation bypasses the preflight checks performed by the fetch() API, potentially allowing unauthorized actions to be performed on behalf of an authenticated user. This issue has been patched in version 16.4.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2025-64166 Mercurius is a GraphQL adapter for Fastify. Prior to version 16.4.0, a cross-site request forgery (CSRF) vulnerability was identified. The issue arises from incorrect… https://www.cve.org/CVERecord?id=CVE-2025-64166
Post summary
A CSRF vulnerability affecting Mercurius GraphQL adapter prior to version 16.4.0 is disclosed; no PoC, exploit, or patch details are provided.
CVE-2025-64166 Cross-Site Request Forgery Vulnerability in Mercurius GraphQL Adapter Before 16.4.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-64166
Post summary
The post announces CVE-2025-64166, a CSRF issue in Mercurius GraphQL Adapter prior to version 16.4.0, and links to a vulnerability detail page.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | mercurius_project | mercurius | - | node.js | - |