Description
A typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers.
Recommendation
Update the @builder.io/qwik-city package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.12.0
- Patched version(s): 1.12.0
References
Could your website be exposed too?
SmartScanner can check your website for Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form- and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Qwik City has a CSRF Protection Bypass via Content-Type Header Validation - CVE-2026-25151
- Qwik City has array method pollution in FormData processing allows type confusion and DoS - CVE-2026-32701
- Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream - CVE-2026-42037
- Qwik City Open Redirect via fixTrailingSlash - CVE-2026-25149
You might also like:
See something that needs correcting? Let us knowUpdated February 11, 2026