CVE-2025-64166: CSRF in Mercurius Node.js Application

The CSRF vulnerability in Mercurius allows an attacker to craft malicious requests that appear to originate from a legitimate user. By exploiting this flaw, an attacker could potentially perform actions such as modifying data, changing user settings, or executing unintended operations within the application. The impact is amplified if the application handles sensitive data or performs critical functions, as an attacker could leverage the vulnerability to gain unauthorized access or control. Successful exploitation requires the user to be authenticated and actively interacting with the application when the malicious request is triggered.

1. Reserved2025-10-28
2. Published2026-03-05
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-64166 is to upgrade to Mercurius version 16.4.0 or later, which includes the fix for the Content-Type parsing issue. If upgrading immediately is not feasible, consider implementing temporary workarounds such as adding CSRF tokens to all sensitive requests or implementing stricter Content-Type validation on the server-side. Web Application Firewalls (WAFs) configured to detect and block suspicious CSRF attacks can also provide an additional layer of protection. After upgrading, confirm the fix by attempting to submit a request with a manipulated Content-Type header and verifying that it is properly rejected.