PT-2026-23452 · Unknown+2 · Fetch() Api+2

Published

2026-03-05

·

Updated

2026-03-13

·

CVE-2025-64166

CVSS v3.1

5.4

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Mercurius versions prior to 16.4.0
Description Mercurius, a GraphQL adapter for Fastify, was found to have a cross-site request forgery (CSRF) issue. The problem stems from the incorrect parsing of the Content-Type header in requests. Specifically, requests with Content-Type values like application/x-www-form-urlencoded, multipart/form-data, or text/plain could be misinterpreted as application/json. This misinterpretation bypasses the preflight checks performed by the fetch() API, potentially allowing unauthorized actions to be performed on behalf of an authenticated user. The fetch() API is a modern interface for making network requests in web browsers. CORS (Cross-Origin Resource Sharing) protections are bypassed, potentially leading to a CSRF attack. A malicious request can be crafted with a Content-Type that Fastify incorrectly parses as application/json.
Recommendations Versions prior to 16.4.0 should be updated to version 16.4.0 or later.

Exploit

Fix

CSRF

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2025-64166
GHSA-V66J-6WWF-JC57

Affected Products

Fastify
Mercurius
Fetch() Api