Qwik City has array method pollution in FormData processing allows type confusion and DoS

Description

Summary

Qwik City improperly inferred arrays from dotted form field names during FormData parsing. By submitting mixed array-index and object-property keys for the same path, an attacker could cause user-controlled properties to be written onto values that application code expected to be arrays.

Recommendation

Update the @builder.io/qwik-city package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.19.2
• Patched version(s): 1.19.2

References

• GHSA-whhv-gg5v-864r
• CVE-2026-32701
• CWE-843
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Prototype Pollution via FormData Processing in Qwik City - CVE-2026-25150
• Qwik City has a CSRF Protection Bypass via Content-Type Header Validation - CVE-2026-25151
• Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form- - CVE-2026-25155
• axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions - CVE-2026-44490

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

@builder.io/qwik-city