CVE-2026-25151: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25151 is a Cross-Site Request Forgery (CSRF) protection bypass vulnerability in Qwik City's server-side request handler, affecting the @builder.io/qwik-city npm package. The flaw allows a remote attacker to circumvent Origin-based CSRF checks by sending specially crafted or multi-valued Content-Type headers, enabling unauthorized state changes. All versions of @builder.io/qwik-city prior to 1.19.0 (for Node.js) are affected. The vulnerability was published on February 3, 2026, and patched in version 1.19.0 the same day. It carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory, GHSA).

The root cause (CWE-352) lies in the checkCSRF function within Qwik City's middleware (resolve-request-handlers.ts), which inconsistently parsed the Content-Type header. Specifically, the original isContentType helper split only on semicolons (;) but not commas (,), allowing an attacker to craft a header such as application/x-www-form-urlencoded, bypass that would be misidentified as a simple form content type, triggering the CSRF origin check — but the comma-delimited suffix could confuse the parser in ways that bypassed the check. Additionally, case-insensitive comparison was not enforced, enabling mixed-case bypass (e.g., TexT/pLaIn). The fix introduced a getContentType helper that splits on both ; and ,, lowercases the result, and applies consistent comparison (GitHub Commit, GitHub Advisory). Exploitation requires user interaction (victim must visit an attacker-controlled page) and a successful CORS preflight, meaning applications with strict CORS policies blocking preflight are not exploitable via browsers.

Successful exploitation allows an attacker to bypass CSRF protections and perform unauthorized state-changing actions on behalf of an authenticated user, resulting in high integrity impact. Confidentiality impact is low, as some response data may be accessible in cross-origin contexts depending on CORS configuration. There is no availability impact. The actual severity of exploitation depends heavily on the target application's CORS and cookie (SameSite) policies — applications with permissive CORS or without SameSite=Strict/Lax cookies are at greater risk (GitHub Advisory, GHSA).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.006–0.009%, placing it in the 1st percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity, user interaction, and a permissive CORS configuration, which collectively limit practical exploitability (GHSA, Feedly).

1. Reconnaissance: Identify a target web application built with @builder.io/qwik-city version prior to 1.19.0 that accepts cross-origin requests (permissive CORS policy) and uses session cookies without SameSite=Strict.
2. Craft malicious page: Create an attacker-controlled web page that, when visited by an authenticated victim, automatically submits a cross-origin HTTP POST request to a state-changing endpoint on the target application.
3. Bypass Content-Type check: Set the Content-Type header to a malformed or multi-valued value such as application/x-www-form-urlencoded, bypass or use mixed casing (e.g., TexT/pLaIn) to confuse the checkCSRF parser into not triggering the origin check, or into misidentifying the request type.
4. Trigger CORS preflight success: Ensure the CORS preflight (OPTIONS request) succeeds on the target server — if the server's CORS policy allows the origin, the preflight will pass and the actual request will proceed.
5. Achieve unauthorized action: The server processes the forged request as if it were a legitimate same-origin form submission, executing the state-changing action (e.g., account modification, data deletion) under the victim's authenticated session (GitHub Advisory, GitHub Commit).

• Network: Unexpected cross-origin POST requests to Qwik City form endpoints with unusual Content-Type headers (e.g., comma-separated values like application/x-www-form-urlencoded, bypass, or mixed-case variants like TexT/pLaIn).
• Logs: Server access logs showing POST requests from unexpected Origin headers that do not match the application's own origin, combined with Content-Type values containing commas or unusual casing.
• Logs: Absence of CSRF check failure errors in application logs despite cross-origin Origin headers being present in form submission requests (indicating the check was bypassed).
• Network: Successful state-changing requests (e.g., profile updates, password changes, data deletions) originating from IP addresses or referrers inconsistent with normal user behavior.

The primary remediation is to upgrade @builder.io/qwik-city to version 1.19.0 or later, which contains the fix for consistent Content-Type header parsing (GitHub Advisory). As defense-in-depth measures, operators should restrict CORS policies to only allow necessary trusted origins and configure session cookies with SameSite=Strict or SameSite=Lax attributes to independently limit CSRF risk. Non-browser API clients should be authenticated via mechanisms not reliant solely on cookies (e.g., bearer tokens). Strict server-side Content-Type validation independent of the framework layer can also reduce exposure.

The vulnerability was reported by security researcher KageShiron and published by Varixo via GitHub's security advisory process on February 3, 2026 (GitHub Advisory). No significant broader media coverage or notable community commentary beyond the advisory and standard vulnerability database entries has been observed, consistent with the moderate severity rating and lack of active exploitation.