Mercurius: 不適切な Content-Type 解析により CSRF 攻撃につながる可能性があります

The CSRF vulnerability in Mercurius allows an attacker to craft malicious requests that appear to originate from a legitimate user. By exploiting this flaw, an attacker could potentially perform actions such as modifying data, changing user settings, or executing unintended operations within the application. The impact is amplified if the application handles sensitive data or performs critical functions, as an attacker could leverage the vulnerability to gain unauthorized access or control. Successful exploitation requires the user to be authenticated and actively interacting with the application when the malicious request is triggered.

Organizations and individuals using Mercurius in production environments, particularly those handling sensitive data or providing critical services, are at risk. Applications with weak CSRF protection or those relying on implicit trust in user-supplied data are especially vulnerable.

• nodejs / server: Monitor application logs for unusual requests with unexpected Content-Type headers (e.g., application/x-www-form-urlencoded when application/json is expected).

grep 'Content-Type: application/x-www-form-urlencoded' /var/log/mercurius/access.log

• generic web: Use curl to test endpoints with manipulated Content-Type headers and observe the application's response.

curl -H "Content-Type: application/x-www-form-urlencoded" https://your-mercurius-app/sensitive-endpoint

1. 2026-03-05Disclosure

   disclosure

1. 予約済み2025-10-28
2. 公開日2026-03-05
3. EPSS 更新日2026-03-23

The primary mitigation for CVE-2025-64166 is to upgrade to Mercurius version 16.4.0 or later, which includes the fix for the Content-Type parsing issue. If upgrading immediately is not feasible, consider implementing temporary workarounds such as adding CSRF tokens to all sensitive requests or implementing stricter Content-Type validation on the server-side. Web Application Firewalls (WAFs) configured to detect and block suspicious CSRF attacks can also provide an additional layer of protection. After upgrading, confirm the fix by attempting to submit a request with a manipulated Content-Type header and verifying that it is properly rejected.