CVE-2025-64166: Mercurius: Incorrect Content-Type parsing can lead to CSRF attack
A Cross-Site Request Forgery (CSRF) vulnerability was identified in Mercurius versions 16. The issue arises from incorrect parsing of the Content-Type header in requests. Specifically, requests with Content-Type values such as application/x-www-form-urlencoded, multipart/form-data, or text/plain could be misinterpreted as application/json. This misinterpretation bypasses the preflight checks performed by the fetch() API, potentially allowing unauthorized actions to be performed on behalf of an authenticated user.
References
- github.com/advisories/GHSA-v66j-6wwf-jc57
- github.com/mercurius-js/mercurius
- github.com/mercurius-js/mercurius/commit/962d402ec7a92342f4a1b7f5f04af01776838c3c
- github.com/mercurius-js/mercurius/pull/1187
- github.com/mercurius-js/mercurius/security/advisories/GHSA-v66j-6wwf-jc57
- nvd.nist.gov/vuln/detail/CVE-2025-64166
Code Behaviors & Features
Detect and mitigate CVE-2025-64166 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →