CVE-2025-64166: 
JavaScript vulnerability analysis and mitigation

CVE-2025-64166 is a Cross-Site Request Forgery (CSRF) vulnerability in Mercurius, a GraphQL adapter for Fastify (Node.js). The flaw stems from incorrect parsing of the Content-Type header, where values such as application/x-www-form-urlencoded, multipart/form-data, or text/plain are misinterpreted as application/json, bypassing the browser's CORS preflight checks. All versions up to and including v16.3.0 are affected; the issue was patched in v16.4.0. It was published on March 5, 2026, with a CVSS v3.1 base score of 5.4 (Medium) (Github Advisory, Mercurius Advisory).

The root cause is classified as CWE-352 (Cross-Site Request Forgery). Fastify's Content-Type parsing logic incorrectly treats certain "simple" request content types (those that do not trigger a CORS preflight) as application/json, allowing a cross-origin POST request to reach the GraphQL endpoint without triggering a preflight OPTIONS check. Because browsers automatically include cookies and credentials with such requests, an attacker-controlled page can issue GraphQL queries or mutations on behalf of an authenticated victim. No special privileges are required by the attacker; the only precondition is that the victim is authenticated to the target Mercurius instance and visits a malicious page. A proof-of-concept is publicly available in the security advisory (Mercurius Advisory, Github Advisory).

Successful exploitation allows an unauthenticated attacker to perform unauthorized GraphQL operations — including queries and mutations — on behalf of an authenticated user without their knowledge or consent. This can result in limited data exposure (confidentiality impact) and unauthorized data modification (integrity impact); availability is not affected. The scope of impact is bounded by the permissions of the targeted user account, but in applications handling sensitive data or performing privileged mutations, the consequences could be significant (Mercurius Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, consisting of a malicious fetch() call with a mismatched Content-Type header and credentials: 'include' (Mercurius Advisory). There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.005% (1st percentile), indicating a low near-term exploitation probability (Github Advisory). No threat actor attribution has been reported.

1. Reconnaissance: Identify a target web application using Mercurius (versions ≤ 16.3.0) as its GraphQL backend, accessible from the internet or an internal network the attacker can reach via a victim's browser.
2. Identify authenticated target: Confirm that the target application uses cookie-based session authentication, as CSRF requires the browser to automatically include credentials.
3. Craft malicious page: Create a web page hosted on an attacker-controlled domain containing a JavaScript fetch() call targeting the victim's GraphQL endpoint:

fetch('https://target.example.com/graphql', {
  method: 'POST',
  body: JSON.stringify({ query: '{ sensitiveData }' }),
  headers: {
    'Content-Type': 'application/x-www-form-urlencoded'
  },
  credentials: 'include'
});

4. Deliver to victim: Trick an authenticated user into visiting the malicious page (e.g., via phishing, malicious ad, or injected link).
5. Bypass preflight: Because application/x-www-form-urlencoded is a "simple" Content-Type, the browser does not send a CORS preflight OPTIONS request. Mercurius incorrectly parses this as application/json and processes the GraphQL request.
6. Achieve objective: The GraphQL operation executes with the victim's session credentials, allowing the attacker to read sensitive data or trigger mutations on their behalf (Mercurius Advisory).

• Network: Unexpected cross-origin POST requests to /graphql endpoints with Content-Type: application/x-www-form-urlencoded, multipart/form-data, or text/plain headers containing a JSON-encoded GraphQL body; requests originating from unfamiliar or suspicious Origin/Referer headers.
• Logs: Server access logs showing POST requests to /graphql with mismatched Content-Type headers (e.g., application/x-www-form-urlencoded) and valid GraphQL query bodies; repeated requests from the same session token across different origin domains.
• Application Behavior: Unexpected GraphQL mutations or data access patterns associated with legitimate user sessions, particularly during off-hours or from unusual geographic locations.

Upgrade Mercurius to version 16.4.0 or later, which introduces built-in CSRF prevention that validates Content-Type headers and optionally requires custom headers (e.g., X-Mercurius-Operation-Name or Mercurius-Require-Preflight) to force preflight checks (Github Advisory, Mercurius PR #1187). CSRF prevention is disabled by default in v16.4.0 and must be explicitly enabled with csrfPrevention: true in the Mercurius registration options. As defense-in-depth, configure strict CORS policies using @fastify/cors with an explicit origin allowlist, and ensure session cookies use the SameSite=Strict or SameSite=Lax attribute.

The vulnerability was reported by researcher simone-sanfratello, who also authored the fix (PR #1187), and was published by maintainer mcollina on March 5, 2026 (Mercurius Advisory). Red Hat acknowledged the CVE in their security tracking (Red Hat CVE). No significant broader media coverage or notable community controversy has been identified.