Description
Qwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission CSRF protections using specially crafted or multi-valued Content-Type headers.
Recommendation
Update the @builder.io/qwik-city package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.19.0
- Patched version(s): 1.19.0
References
Could your website be exposed too?
SmartScanner can check your website for Qwik City has a CSRF Protection Bypass via Content-Type Header Validation and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form- - CVE-2026-25155
- Qwik City has array method pollution in FormData processing allows type confusion and DoS - CVE-2026-32701
- Feathers has an origin validation bypass via prefix matching - CVE-2026-27192
- SillyTavern has Authentication Bypass via SSO Header Injection - CVE-2026-44649
You might also like:
See something that needs correcting? Let us knowUpdated February 04, 2026