GitHub Advisoryadvisory · npm

GHSA-vm6g-8r4h-22x8 Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)

MEDIUM Published 2026-02-03 Modified 2026-02-11 Official page ↗
Aliases
CVE-2026-25155
Ecosystem
npm
Packages
@builder.io/qwik-city
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N
Weaknesses
CWE-352
Reviewed
2026-02-03

Affected packages

• npm @builder.io/qwik-city: < 1.12.0 → fixed in 1.12.0

Description

Summary A typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers. Impact An attacker can bypass Qwik City’s Origin-based CSRF protections and perform forged form submissions, potentially causing unauthorized state changes.

Related

Alias · CVE (1)

  • CVE-2026-25155 Qwik is a performance focused javascript framework. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References