5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-64166

CVE-2025-64166: Mercurius: Incorrect Content-Type parsing can lead to CSRF attack

Mercurius is a GraphQL adapter for Fastify. Prior to version 16.4.0, a cross-site request forgery (CSRF) vulnerability was identified. The issue arises from incorrect parsing of the Content-Type header in requests. Specifically, requests with Content-Type values such as application/x-www-form-urlencoded, multipart/form-data, or text/plain could be misinterpreted as application/json. This misinterpretation bypasses the preflight checks performed by the fetch() API, potentially allowing unauthorized actions to be performed on behalf of an authenticated user. This issue has been patched in version 16.4.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-64166

CVE-2025-64166:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mercurius	npm	<= 16.3.0	16.4.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Cross-Site Request Forgery (CSRF) in Mercurius, identified as GHSA-v66j-6wwf-jc57. It arises from the incorrect handling of the Content-Type header for incoming requests to the GraphQL endpoint. The application would process requests with 'simple' Content-Types (e.g., text/plain, application/x-www-form-urlencoded) as if they were application/json, without requiring a CORS preflight check. This allowed attackers to craft malicious requests on other websites that, when visited by an authenticated user, would be sent to the GraphQL endpoint with the user's credentials, leading to unauthorized actions.

The patch addresses this by introducing a CSRF prevention mechanism. A new file, lib/csrf.js, is added, which contains the core logic for the fix in the checkCSRFPrevention function. This function validates incoming requests based on their Content-Type and the presence of specific headers.

The fix is applied in lib/routes.js by adding an onRequest hook to the Fastify route definitions for both GET and POST methods. This hook calls checkCSRFPrevention for every request to the GraphQL endpoint. If a request does not meet the new security criteria (i.e., it has a 'simple' Content-Type and lacks a required preflight-triggering header), it is blocked before it reaches the main request handler.

The vulnerable functions are the anonymous route handlers for GET and POST requests in lib/routes.js. In the unpatched versions, these handlers would process potentially malicious requests without any CSRF validation. During exploitation, these are the functions that would appear in a runtime profile as they process the forged request.

Vulnerable functions

[anonymous] GET /graphql handler

lib/routes.js

This anonymous function is the route handler for GET requests to the GraphQL endpoint. In the vulnerable version, it lacked CSRF validation, allowing an attacker to execute a CSRF attack by crafting a request with a 'simple' Content-Type that does not trigger a CORS preflight check. The patch adds an 'onRequest' hook that executes 'checkCSRFPrevention' before this handler is called.

[anonymous] POST /graphql handler

lib/routes.js

This anonymous function is the route handler for POST requests to the GraphQL endpoint. In the vulnerable version, it was susceptible to CSRF because it did not validate the request's Content-Type. An attacker could send a POST request with a Content-Type like 'text/plain' or 'application/x-www-form-urlencoded', which the server would incorrectly process as JSON, bypassing CORS preflight checks. The patch mitigates this by adding an 'onRequest' hook to validate the request before the handler is invoked.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.