Description
Summary
Qwik City improperly inferred arrays from dotted form field names during FormData parsing. By submitting mixed array-index and object-property keys for the same path, an attacker could cause user-controlled properties to be written onto values that application code expected to be arrays.
Recommendation
Update the @builder.io/qwik-city package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.19.2
- Patched version(s): 1.19.2
References
Could your website be exposed too?
SmartScanner can check your website for Qwik City has array method pollution in FormData processing allows type confusion and DoS and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Prototype Pollution via FormData Processing in Qwik City - CVE-2026-25150
- Qwik City has a CSRF Protection Bypass via Content-Type Header Validation - CVE-2026-25151
- Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form- - CVE-2026-25155
- axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions - CVE-2026-44490
You might also like:
See something that needs correcting? Let us knowUpdated March 20, 2026