CVE-2026-25151
CSRF Bypass via Header Parsing Flaw in Qwik City Server
Publication date: 2026-02-03
Last updated on: 2026-02-10
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| qwik | qwik | to 1.19.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Qwik City’s server-side request handler prior to version 1.19.0. The handler inconsistently interprets HTTP request headers, specifically the Content-Type headers. A remote attacker can exploit this inconsistency by sending specially crafted or multi-valued Content-Type headers to bypass form submission CSRF (Cross-Site Request Forgery) protections.
How can this vulnerability impact me? :
The vulnerability allows a remote attacker to circumvent CSRF protections on form submissions. This means an attacker could potentially perform unauthorized actions on behalf of a user without their consent by exploiting the inconsistent handling of Content-Type headers. The impact includes a high integrity risk, as unauthorized changes or actions could be performed, although the confidentiality impact is low and availability is not affected.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The vulnerability in Qwik City’s server-side request handler has been patched in version 1.19.0.
To mitigate this vulnerability, you should upgrade Qwik to version 1.19.0 or later.