CVE-2025-64166

CVE-2025-64166 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Mercurius, a GraphQL adapter for Fastify, in versions prior to 16.4.0. The flaw stems from incorrect Content-Type header parsing, where non-JSON requests (e.g., application/x-www-form-urlencoded) are misinterpreted as application/json, bypassing standard browser preflight checks. This medium-severity vulnerability (CVSS 5.4) has a network attack vector and low attack complexity, requiring user interaction. A successful exploit could lead to unauthorized actions performed on behalf of an authenticated user, resulting in low confidentiality and integrity impacts. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.