CVE-2026-25151

Unknown Unknown - Not Provided

CSRF Bypass via Header Parsing Flaw in Qwik City Server

Publication date: 2026-02-03

Last updated on: 2026-02-10

Assigner: GitHub, Inc.

Description

Qwik is a performance focused javascript framework. Prior to version 1.19.0, Qwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission CSRF protections using specially crafted or multi-valued Content-Type headers. This issue has been patched in version 1.19.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-03

Last Modified

2026-02-10

Generated

2026-07-06

AI Q&A

2026-02-04

EPSS Evaluated

2026-07-05

NVD

CVE-2026-25151

EUVD

EUVD-2026-5167

Affected Vendors & Products

Vendor	Product	Version / Range
qwik	qwik	to 1.19.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Qwik City’s server-side request handler prior to version 1.19.0. The handler inconsistently interprets HTTP request headers, specifically the Content-Type headers. A remote attacker can exploit this inconsistency by sending specially crafted or multi-valued Content-Type headers to bypass form submission CSRF (Cross-Site Request Forgery) protections.

Impact Analysis

The vulnerability allows a remote attacker to circumvent CSRF protections on form submissions. This means an attacker could potentially perform unauthorized actions on behalf of a user without their consent by exploiting the inconsistent handling of Content-Type headers. The impact includes a high integrity risk, as unauthorized changes or actions could be performed, although the confidentiality impact is low and availability is not affected.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

The vulnerability in Qwik City’s server-side request handler has been patched in version 1.19.0.

To mitigate this vulnerability, you should upgrade Qwik to version 1.19.0 or later.

Hi! I’m here to help you understand CVE-2026-25151. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70