Qwik
CVE-2026-25151
MEDIUM
GHSA-r666-8gjf-4v5f
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N
Lifecycle Timeline
3DescriptionGitHub Advisory
Qwik is a performance focused javascript framework. Prior to version 1.19.0, Qwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission CSRF protections using specially crafted or multi-valued Content-Type headers. This issue has been patched in version 1.19.0.
AnalysisAI
Qwik is a performance focused javascript framework. [CVSS 5.9 MEDIUM]
Technical ContextAI
Classified as CWE-352 (Cross-Site Request Forgery (CSRF)). Affects Qwik. Qwik is a performance focused javascript framework. Prior to version 1.19.0, Qwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission CSRF protections using specially crafted or multi-valued Content-Type headers. This issue has been patched in version 1.19.0.
RemediationAI
A vendor patch is available — apply it immediately. Fixed in version 1.19.0.. Restrict network access to the affected service where possible.
RCE in Qwik JavaScript framework <= 1.19.0 via unsafe deserialization in server$ Runtime. EPSS 13.4% with PoC available.
Code injection in Qwik framework before 0.21.0. PoC and patch available.
Qwik is a performance focused javascript framework. Rated medium severity (CVSS 6.1), this vulnerability is remotely exp
Qwik JavaScript framework prior to 1.19.0 has a prototype pollution vulnerability that can lead to server-side code exec
Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0.
Qwik, a performance-focused JavaScript framework, contains an array prototype pollution vulnerability in its FormData pa
A Cross-site Scripting (XSS) vulnerability exists in the Qwik framework (Node.js) prior to version 0.1.0-beta5, allowing
Improper serialization of virtual attributes in Qwik versions prior to 1.19.0 enables stored cross-site scripting attack
Qwik versions up to 1.19.0 is affected by url redirection to untrusted site (open redirect) (CVSS 6.1).
Qwik versions prior to 1.12.0 contain a regular expression parsing error in the isContentType function that allows attac
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today