Qwik City has a CSRF Protection Bypass via Content-Type Header Validation

Description

Qwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission CSRF protections using specially crafted or multi-valued Content-Type headers.

Recommendation

Update the @builder.io/qwik-city package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.19.0
• Patched version(s): 1.19.0

References

• GHSA-r666-8gjf-4v5f
• CVE-2026-25151
• CWE-352
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form- - CVE-2026-25155
• Qwik City has array method pollution in FormData processing allows type confusion and DoS - CVE-2026-32701
• Feathers has an origin validation bypass via prefix matching - CVE-2026-27192
• SillyTavern has Authentication Bypass via SSO Header Injection - CVE-2026-44649

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

CSRF, XXE, and 12 Other Security Acronyms Explained

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

Tags:

npm

@builder.io/qwik-city