| Package | Affected versions | Patched versions |
|---|---|---|
| qwik | < 1.12.0 | 1.12.0 |
| @builder.io/qwik-city | < 1.12.0 | 1.12.0 |
A typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers.
An attacker can bypass Qwik City’s Origin-based CSRF protections and perform forged form submissions, potentially causing unauthorized state changes.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free