CVE-2025-64166
1 advisory.
npm/mercurius CVE-2025-64166: medium 5.4, EPSS 0.17%
Mercurius: Incorrect Content-Type parsing can lead to CSRF attack
Action: Upgrade mercurius to 16.4.0 or later.
npm i mercurius@16.4.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 16.4.0 | - |
Fixed versions
| 16.4.0 |
Sources
- osv: GHSA-v66j-6wwf-jc57
- https://github.com/mercurius-js/mercurius/security/advisories/GHSA-v66j-6wwf-jc57
- https://nvd.nist.gov/vuln/detail/CVE-2025-64166
- https://github.com/mercurius-js/mercurius/pull/1187
- https://github.com/mercurius-js/mercurius/commit/962d402ec7a92342f4a1b7f5f04af01776838c3c
- https://github.com/mercurius-js/mercurius
CVE-2025-64166 · published · modified · JSON