~ / search / GHSA-vm6g-8r4h-22x8

GHSA-vm6g-8r4h-22x8

Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-25155

Packages

EcosystemPackageAffectedFixed in
npm @builder.io/qwik-city < 1.12.0 1.12.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary A typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers. ### Impact An attacker can bypass Qwik City’s Origin-based CSRF protections and perform forged form submissions, potentially causing unauthorized state changes.

References

External links from the advisory. They lead to third-party sites.