Skip to content
CVE PROGRAM SOURCE RECORD5.9 Medium

CVE-2026-25155

[qwik-city] CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers. This issue has been patched in version 1.12.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

QwikDev qwik

  • < 1.12.0affected

References