{"action":"Upgrade mercurius to 16.4.0 or later.","affected":[{"fixed":"16.4.0","introduced":"0"}],"component":"mercurius","cve_ids":["CVE-2025-64166"],"ecosystem":"npm","epss":0.00169,"exploited":false,"fixed_versions":["16.4.0"],"ghsa_id":"GHSA-v66j-6wwf-jc57","id":"tcs_01M5KGAYTQRRTW2T2PBJJWWSM2","modified_at":"2026-03-05T20:46:36.485530Z","published_at":"2026-03-05T18:18:01Z","references":["https://osv.dev/vulnerability/GHSA-v66j-6wwf-jc57","https://github.com/mercurius-js/mercurius/security/advisories/GHSA-v66j-6wwf-jc57","https://nvd.nist.gov/vuln/detail/CVE-2025-64166","https://github.com/mercurius-js/mercurius/pull/1187","https://github.com/mercurius-js/mercurius/commit/962d402ec7a92342f4a1b7f5f04af01776838c3c","https://github.com/mercurius-js/mercurius"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-v66j-6wwf-jc57","url":"https://osv.dev/vulnerability/GHSA-v66j-6wwf-jc57"}],"summary":"Mercurius: Incorrect Content-Type parsing can lead to CSRF attack"}