CVE-2026-32701: Qwik City Array Method Pollution Vulnerability
Summary
CVE-2026-32701: Qwik City has array method pollution in FormData processing allows type confusion and DoS. Affects @builder.io/qwik-city versions < 1.19.2. Fixed in 1.19.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Qwik City is a framework designed for building fast, server-rendered web applications. It allows developers to create applications that are optimized for performance and user experience. However, a vulnerability has been identified in its FormData processing, which can lead to unexpected behaviors when handling form submissions.
Vulnerability Detail
The vulnerability arises from Qwik City's improper handling of dotted form field names during FormData parsing. When processing requests with 'application/x-www-form-urlencoded' or 'multipart/form-data', the framework converts dotted field names into nested structures. This can lead to type confusion and denial of service (DoS) when an attacker submits mixed array-index and object-property keys for the same path. For instance, if an attacker uses keys like 'items.toString' or 'items.length', it can alter the expected array structure, resulting in runtime errors or inflated memory usage. The primary risk associated with this vulnerability is denial of service and application instability, rather than direct confidentiality or integrity impacts.
How To Fix
Latest published version: 1.20.2 as of 22 Oct 2026
npm install @builder.io/qwik-city@1.20.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.19.2
This is the first release that contains the fix.
npm install @builder.io/qwik-city@1.19.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Until the package is updated, avoid trusting parsed form data to be a well-formed array when using dotted field names. Implement validation or normalization of input data before using array methods or relying on the expected array shape. For example, you can check if the parsed data is an array before proceeding with array operations:
if (Array.isArray(parsedData)) {
// Safe to use array methods
} else {
// Handle the unexpected structure
}
Conclusion
The vulnerability identified as CVE-2026-32701 in Qwik City poses significant risks related to array method pollution during FormData processing. It is crucial for developers to update to the patched version 1.19.2 to mitigate these risks. Until then, implementing workarounds and validating input data is essential to maintain application stability.
See every vulnerability recorded for @builder.io/qwik-city →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
No, the vulnerability does not require authentication if the vulnerable route is publicly accessible.
The vulnerability affects requests with 'application/x-www-form-urlencoded' and 'multipart/form-data' content types.
There is no direct evidence that this vulnerability leads to confidentiality or integrity breaches; the primary risk is denial of service.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. It requires only the package-lock.json file to operate.
References
Related vulnerabilities
Recent vulnerabilities recorded for @builder.io/qwik-city.
