CVE-2026-25151
Unknown Unknown - Not Provided
CSRF Bypass via Header Parsing Flaw in Qwik City Server

Publication date: 2026-02-03

Last updated on: 2026-02-10

Assigner: GitHub, Inc.

Description
Qwik is a performance focused javascript framework. Prior to version 1.19.0, Qwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission CSRF protections using specially crafted or multi-valued Content-Type headers. This issue has been patched in version 1.19.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-03
Last Modified
2026-02-10
Generated
2026-06-16
AI Q&A
2026-02-04
EPSS Evaluated
2026-06-15
NVD
CVE-2026-25151
EUVD
EUVD-2026-5167
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
qwik qwik to 1.19.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in Qwik City’s server-side request handler prior to version 1.19.0. The handler inconsistently interprets HTTP request headers, specifically the Content-Type headers. A remote attacker can exploit this inconsistency by sending specially crafted or multi-valued Content-Type headers to bypass form submission CSRF (Cross-Site Request Forgery) protections.

Impact Analysis

The vulnerability allows a remote attacker to circumvent CSRF protections on form submissions. This means an attacker could potentially perform unauthorized actions on behalf of a user without their consent by exploiting the inconsistent handling of Content-Type headers. The impact includes a high integrity risk, as unauthorized changes or actions could be performed, although the confidentiality impact is low and availability is not affected.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

The vulnerability in Qwik City’s server-side request handler has been patched in version 1.19.0.

To mitigate this vulnerability, you should upgrade Qwik to version 1.19.0 or later.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-25151. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart