CVE-2026-25155: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25155 is a Cross-Site Request Forgery (CSRF) vulnerability in the Qwik City middleware component of the Qwik JavaScript framework. A typo in the regular expression within the isContentType function causes incorrect parsing of certain Content-Type headers (e.g., multipart/form-data with boundary parameters), allowing attackers to bypass Origin-based CSRF protections. All versions of @builder.io/qwik-city prior to 1.12.0 are affected. The vulnerability was published on February 3, 2026, and patched in version 1.12.0. It carries a CVSS v3.1 base score of 5.9 (Moderate) per the GitHub Advisory, with an alternative score of 7.1 (High) from NVD (Github Advisory, Qwik Security Advisory).

The root cause is a typo in the regular expression used by the isContentType function in packages/qwik-city/src/middleware/request-handler/resolve-request-handlers.ts. The original regex /;,/ was intended to split the Content-Type header on semicolons to extract the MIME type, but the erroneous inclusion of a comma caused the function to fail to correctly parse headers that include parameters (e.g., multipart/form-data; boundary=...). As a result, the CSRF protection middleware could not properly identify the content type, allowing crafted requests with such headers to bypass the Origin-based CSRF check (CWE-352). The fix, committed in d70d709, corrects the regex to /;/, ensuring proper parsing (Qwik Commit, Qwik Security Advisory).

Successful exploitation allows an attacker to bypass Qwik City's Origin-based CSRF protections and perform forged form submissions on behalf of authenticated users, potentially causing unauthorized state changes in the application. The primary impact is on integrity (High), with a limited confidentiality impact (Low) and no availability impact. Exploitation requires user interaction — a victim must be tricked into visiting a malicious page or clicking a crafted link while authenticated to a vulnerable Qwik City application (Github Advisory, Qwik Security Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.008% (1st percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity, as the attacker must craft a request with a specially formatted Content-Type header and induce user interaction (Github Advisory).

1. Identify target: Locate a web application built with Qwik City (npm package @builder.io/qwik-city) running a version prior to 1.12.0 that relies on the built-in Origin-based CSRF protection middleware.
2. Craft malicious page: Create an attacker-controlled web page containing an HTML form that targets a state-changing endpoint on the victim application (e.g., account settings, data submission).
3. Set Content-Type with parameters: Configure the form to submit with a multipart/form-data Content-Type header that includes boundary parameters (e.g., multipart/form-data; boundary=----boundary123). Due to the regex typo, the isContentType function will fail to correctly parse this header, causing the CSRF check to be bypassed.
4. Induce user interaction: Trick an authenticated victim into visiting the malicious page (e.g., via phishing email or malicious link), causing their browser to automatically submit the forged form to the target application.
5. Achieve unauthorized action: The target server processes the forged request as if it were a legitimate action from the authenticated user, resulting in unauthorized state changes (Qwik Security Advisory, Qwik Commit).

• Network: Unexpected cross-origin POST requests to Qwik City application endpoints with Content-Type: multipart/form-data; boundary=... headers originating from external or unknown referrers.
• Logs: Server access logs showing form submission requests to state-changing endpoints with a Referer or Origin header from an unrecognized or external domain, combined with multipart/form-data content types.
• Application Behavior: Unexpected or unauthorized state changes (e.g., account modifications, data submissions) in the application that do not correspond to legitimate user activity.

Upgrade the @builder.io/qwik-city npm package to version 1.12.0 or later, which contains the corrected regex in the isContentType function. For organizations unable to upgrade immediately, implement supplementary CSRF protections: set SameSite=Strict or SameSite=Lax on session cookies, add explicit CSRF tokens to all state-changing requests, and configure Content Security Policy (CSP) headers to restrict cross-origin requests. These workarounds reduce risk but do not fully remediate the underlying vulnerability (Github Advisory, Qwik Security Advisory).

The vulnerability was discovered and reported by researcher Varixo and published via the GitHub Security Advisory program on February 3, 2026. No significant broader media coverage or notable community commentary beyond the advisory itself has been identified at this time (Qwik Security Advisory).