{"id":"CVE-2026-25155","aliases":["EUVD-2026-5168","GHSA-vm6g-8r4h-22x8"],"status":"published","title":"[qwik-city] CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)","description":"Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers. This issue has been patched in version 1.12.0.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00147,"percentile":0.03965,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2026-02-03T20:59:18Z","modified":"2026-10-28T02:31:05Z","fixes":[{"ecosystem":"npm","package":"@builder.io/qwik-city","fixed_in":["1.12.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@builder.io/qwik-city","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@builder.io/qwik-city","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.12.0"}]}]}],"products":[{"vendor":"qwik","product":"qwik"},{"vendor":"qwikdev","product":"qwik"}],"references":[{"url":"https://github.com/QwikDev/qwik/security/advisories/GHSA-vm6g-8r4h-22x8","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/QwikDev/qwik/commit/d70d7099b90b998f1aac7cedc21c67d87bac4c75","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25155","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vm6g-8r4h-22x8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25155.json","tags":["advisory"]},{"url":"https://github.com/QwikDev/qwik","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-25155","title":"[qwik-city] CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)","description":"Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers. This issue has been patched in version 1.12.0.","status":"published","published":"2026-02-03T21:12:13.235Z","modified":"2026-02-04T16:59:56.03Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T13:41:30.911526Z"}],"euvd":[{"id":"EUVD-2026-5168","description":"Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers. This issue has been patched in version 1.12.0.","status":"published","published":"2026-02-03T21:12:13Z","modified":"2026-02-04T16:59:56Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:44.193176Z"}],"ghsa":[{"id":"GHSA-vm6g-8r4h-22x8","title":"Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)","description":"### Summary\nA typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers.\n\n### Impact\nAn attacker can bypass Qwik City’s Origin-based CSRF protections and perform forged form submissions, potentially causing unauthorized state changes.","status":"published","published":"2026-02-03T20:59:18Z","modified":"2026-02-11T14:13:57Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:39:24.742346Z"}],"nvd":[{"id":"CVE-2026-25155","description":"Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers. This issue has been patched in version 1.12.0.","status":"published","published":"2026-02-03T22:16:30.987Z","modified":"2026-06-17T10:24:12.313Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:12:05.149641Z"}],"osv":[{"id":"CVE-2026-25155","title":"[qwik-city] CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)","description":"Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers. This issue has been patched in version 1.12.0.","status":"published","published":"2026-02-03T21:12:13.235Z","modified":"2026-10-28T02:31:05.527609505Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:44:59.438965Z"},{"id":"GHSA-vm6g-8r4h-22x8","title":"Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)","description":"### Summary\nA typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers.\n\n### Impact\nAn attacker can bypass Qwik City’s Origin-based CSRF protections and perform forged form submissions, potentially causing unauthorized state changes.","status":"published","published":"2026-02-03T20:59:18Z","modified":"2026-02-11T15:03:51.313099Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:57.348035Z"}]}}