Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)

HIGH 7.1CVE-2026-25155 · GHSA-vm6g-8r4h-22x8 · Published 03/02/2026 · updated 17/06/2026

In short

CVE-2026-25155 is a HIGH (CVSS 7.1) vulnerability affecting qwik (qwik), @builder.io/qwik-city.
Chance of exploitation in the next 30 days (EPSS): 0.15%, higher than 3.9% of all vulnerabilities.
Fix: update to 1.12.0 or later.

Package	Affected versions	Patched versions
qwik qwik	`< 1.12.0`	`1.12.0`
@builder.io/qwik-city npm	`< 1.12.0`	`1.12.0`

Description

Summary

A typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers.

Impact

An attacker can bypass Qwik City’s Origin-based CSRF protections and perform forged form submissions, potentially causing unauthorized state changes.

NVD description

Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers. This issue has been patched in version 1.12.0.

References

QwikDev/qwik security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-25155 · ADVISORY
QwikDev/qwik commit d70d709 · WEB
QwikDev/qwik · PACKAGE

More vulnerabilities in qwik

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

qwik

< 1.12.0

1.12.0

@builder.io/qwik-city

npm

< 1.12.0

1.12.0

Description

Summary

A typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers.

Impact

An attacker can bypass Qwik City’s Origin-based CSRF protections and perform forged form submissions, potentially causing unauthorized state changes.

NVD description

More vulnerabilities in qwik

See all →