CVE-2026-25151: Qwik City CSRF Protection Bypass via Content-Type Header Validation
Summary
CVE-2026-25151: Qwik City has a CSRF Protection Bypass via Content-Type Header Validation. Affects @builder.io/qwik-city versions < 1.19.0. Fixed in 1.19.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Qwik City is a framework designed for building web applications with a focus on performance and developer experience. It allows developers to create highly interactive applications with minimal overhead. However, it has a vulnerability related to its server-side request handling, specifically in how it interprets HTTP request headers, which can lead to security issues.
Vulnerability Detail
The vulnerability arises from an inconsistency in how Qwik City's server-side request handler interprets HTTP request headers. This inconsistency can be exploited by a remote attacker to bypass Cross-Site Request Forgery (CSRF) protections. By using specially crafted or multi-valued Content-Type headers, an attacker can circumvent Origin-based CSRF checks. Successful exploitation requires that the CORS preflight request succeeds, which may depend on the server's CORS and cookie policies. The potential ramifications include unauthorized state changes within the application, posing a moderate security risk.
How To Fix
Latest published version: 1.20.2 as of 22 Oct 2026
npm install @builder.io/qwik-city@1.20.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.19.0
This is the first release that contains the fix.
npm install @builder.io/qwik-city@1.19.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement stricter validation of Content-Type headers in your server-side request handling logic. Ensure that only expected and valid Content-Type values are processed, and reject any malformed or multi-valued headers.
Conclusion
The CSRF protection bypass vulnerability in Qwik City highlights the importance of proper header validation in web applications. By updating to the latest version and implementing recommended workarounds, developers can mitigate the risks associated with this vulnerability.
See every vulnerability recorded for @builder.io/qwik-city →
FAQ
The vulnerability allows attackers to bypass CSRF protections by manipulating Content-Type headers in HTTP requests.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without signup.
The potential impacts include unauthorized state changes within your application, which could compromise user data or application integrity.
Yes, a patch is available in version 1.19.0 of the Qwik City package. Updating to this version will resolve the issue.
The CVSS score of this vulnerability is 5.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @builder.io/qwik-city.
