web3.db-fileconnector (>=1.4.0, <=1.8.6) potentially affected by CVE-2025-64166 via mercurius (16.1.0)

mercurius NPM version 16.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on mercurius and may be impacted: - web3.db-fileconnector =1.4.0, =1.8.6 Source cves: CVE-2025-64166 Source advisory: SNYK:JS-MERCURIUS-15428327...

web3.db-fileconnector (>=1.4.0, <=1.8.6) potentially affected by CVE-2025-64166 via mercurius (16.1.0)

mercurius NPM version 16.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on mercurius and may be impacted: - web3.db-fileconnector =1.4.0, =1.8.6 Source cves: CVE-2025-64166 Source advisory: OSV:GHSA-V66J-6WWF-JC57...

CVE-2025-64166

creationtimestamp| type| source ---|---|--- 2026-03-05 14:34:53+00:00| published-proof-of-concept| https://github.com/mercurius-js/mercurius/security/advisories/GHSA-v66j-6wwf-jc57 2026-03-05 17:53:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgdej53i4324...