CVE-2026-32701: 
JavaScript vulnerability analysis and mitigation

CVE-2026-32701 is an array method pollution vulnerability in Qwik City's FormData processing that allows type confusion and denial of service. The flaw affects the @builder.io/qwik-city npm package in all versions prior to 1.19.2, where dotted form field names are improperly parsed into nested structures, enabling attackers to inject non-integer keys (e.g., items.toString, items.push) alongside array-index keys to corrupt server-side data structures. It was published on March 20, 2026, with a fix released in version 1.19.2. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Qwik Security Advisory).

The root cause is improper array inference in Qwik City's formToObj function, which converts dotted field names (e.g., items.0, items.1) in application/x-www-form-urlencoded or multipart/form-data requests into nested JavaScript structures. The original code used Number.isNaN(+key) to decide whether to create an array or object, but failed to validate that all sibling keys under a given path were canonical non-negative integers before committing to an array type. This allowed an attacker to submit mixed keys such as items.0=apple&items.toString=malicious, causing properties like toString, push, valueOf, or length to be written onto what application code expected to be a plain array — classified as CWE-843 (Type Confusion) and CWE-1321 (Prototype Pollution). The fix (commit 7b5867c) introduces a pre-pass getArrayPaths() function that scans all FormData keys first and only designates a path as an array if every child key is a canonical non-negative integer (/^(0|[1-9]\d*)$/) (Qwik Security Advisory, Patch Commit).

The primary impact is denial of service and application instability — there is no direct evidence of confidentiality or integrity compromise. An unauthenticated remote attacker can trigger runtime errors when application code calls array methods on attacker-influenced values, inflate array lengths to increase server memory usage, or cause type confusion in downstream logic that trusts parsed form data to be a well-formed array. The vulnerability is exploitable on any publicly reachable Qwik City route that processes form submissions without requiring authentication or user interaction (Github Advisory, Qwik Security Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.046% (15th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Github Advisory, Feedly).

1. Reconnaissance: Identify web applications built with Qwik City (npm package @builder.io/qwik-city) running versions prior to 1.19.2 that expose publicly accessible form submission endpoints.
2. Identify target route: Locate any route that processes application/x-www-form-urlencoded or multipart/form-data POST requests and uses dotted field names to build nested objects (e.g., a form with fields like items.0, items.1).
3. Craft malicious FormData: Construct a request that mixes valid array-index keys with non-integer property keys for the same path, for example:

   POST /submit HTTP/1.1
   Content-Type: application/x-www-form-urlencoded
   
   items.0=apple&items.1=banana&items.length=999999999&items.push=malicious

4. Submit the request: Send the crafted request to the vulnerable endpoint. Qwik City's formToObj will interpret items as an array but also write attacker-controlled values onto items.length, items.push, etc.
5. Trigger downstream failure: Application code that subsequently calls array methods (e.g., .map(), .forEach()) on the corrupted items value will encounter type confusion or runtime errors, potentially crashing the request handler or causing excessive memory allocation via an inflated length property (Qwik Security Advisory, Patch Commit).

• Network: Repeated POST requests to form-handling endpoints containing mixed dotted field names (e.g., items.0, items.toString, items.length, items.push, items.valueOf) in the request body; unusually large Content-Length values in form submissions.
• Logs: Server-side JavaScript runtime errors (e.g., TypeError: items.map is not a function) in application logs following form POST requests; elevated error rates on specific routes that process form data.
• Process: Increased Node.js memory consumption or CPU spikes coinciding with form submission traffic, potentially indicating malformed array state causing excessive server work.

Upgrade @builder.io/qwik-city to version 1.19.2 or later, which contains the fix that pre-validates all sibling keys before designating a path as an array. As a temporary workaround for deployments that cannot immediately upgrade, avoid trusting parsed form data to be a well-formed array when using dotted field names — validate and normalize all action input before calling array methods or relying on array shape. Since the vulnerability requires no authentication and no user interaction, patching should be prioritized for all internet-facing Qwik City deployments (Qwik Security Advisory, Patch Commit).