CVE-2026-25155

CVE-2026-25155 · [qwik-city] CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers. This issue has been patched in version 1.12.0.

CVSS 5.9 · Medium · EPSS 0.1% · Fix available

Published: 2026-02-03T21:12:13.235Z
Updated: 2026-02-04T16:59:56.030Z

Stack: node

Affected products and versions

qwik
Versions
- < 1.12.0: Affected
No fix published
@builder.io/qwik-city npm
Affected ranges
- SEMVER: < 1.12.0
Update to 1.12.0

Original sources

https://github.com/QwikDev/qwik/security/advisories/GHSA-vm6g-8r4h-22x8
https://github.com/QwikDev/qwik/commit/d70d7099b90b998f1aac7cedc21c67d87bac4c75
https://nvd.nist.gov/vuln/detail/CVE-2026-25155

Check your server →

CVE-2026-25155 · [qwik-city] CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)

Affected products and versions

qwik

@builder.io/qwik-city npm

Original sources