PT-2026-23452 · Unknown+2 · Fetch() Api+2
Publicado
2026-03-05
·
Atualizado
2026-03-13
·
CVE-2025-64166
CVSS v3.1
5.4
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Mercurius versions prior to 16.4.0
Description
Mercurius, a GraphQL adapter for Fastify, was found to have a cross-site request forgery (CSRF) issue. The problem stems from the incorrect parsing of the
Content-Type header in requests. Specifically, requests with Content-Type values like application/x-www-form-urlencoded, multipart/form-data, or text/plain could be misinterpreted as application/json. This misinterpretation bypasses the preflight checks performed by the fetch() API, potentially allowing unauthorized actions to be performed on behalf of an authenticated user. The fetch() API is a modern interface for making network requests in web browsers. CORS (Cross-Origin Resource Sharing) protections are bypassed, potentially leading to a CSRF attack. A malicious request can be crafted with a Content-Type that Fastify incorrectly parses as application/json.Recommendations
Versions prior to 16.4.0 should be updated to version 16.4.0 or later.
Exploit
Correção
CSRF
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Fastify
Mercurius
Fetch() Api