What is the CVSS score of EUVD-2026-13639?

EUVD-2026-13639 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Qwik are affected by EUVD-2026-13639?

A critical vulnerability in Qwik framework versions before 1.19.2 allows attackers to disrupt application availability through specially crafted form submissions without requiring authentication or…. A patch is available.

How to fix or mitigate EUVD-2026-13639?

Within 24 hours: Inventory all applications using Qwik framework and identify those running versions prior to 1.19.2; immediately implement WAF rules to block malicious form field patterns (mixed array-index and object-property keys). Within 7 days: Upgrade all affected Qwik installations to version 1.19.2 or later; validate patch deployment across all environments. Within 30 days: Conduct regression testing on upgraded applications; review form input handling logs for exploitation attempts; document remediation completion for compliance records.

Qwik EUVD-2026-13639

| CVE-2026-32701 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-03-20 GitHub_M

GHSA-whhv-gg5v-864r

Memory Corruption Denial Of Service Qwik

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 20, 2026 - 09:18 euvd

EUVD-2026-13639

Analysis Generated

Mar 20, 2026 - 09:18 vuln.today

CVE Published

Mar 20, 2026 - 08:52 nvd

HIGH 7.5

DescriptionGitHub Advisory

Qwik is a performance-focused JavaScript framework. Versions prior to 1.19.2 improperly inferred arrays from dotted form field names during FormData parsing. By submitting mixed array-index and object-property keys for the same path, an attacker could cause user-controlled properties to be written onto values that application code expected to be arrays. When processing application/x-www-form-urlencoded or multipart/form-data requests, Qwik City converted dotted field names (e.g., items.0, items.1) into nested structures. If a path was interpreted as an array, additional attacker-supplied keys on that path-such as items.toString, items.push, items.valueOf, or items.length-could alter the resulting server-side value in unexpected ways, potentially leading to request handling failures, denial of service through malformed array state or oversized lengths, and type confusion in downstream code. This issue was fixed in version 1.19.2.

AnalysisAI

Qwik, a performance-focused JavaScript framework, contains an array prototype pollution vulnerability in its FormData parsing logic that affects versions prior to 1.19.2. Attackers can submit specially crafted form field names using mixed array-index and object-property keys (e.g., items.0 alongside items.toString or items.length) to inject malicious properties into objects the application expects to be arrays, leading to denial of service through malformed array states, oversized lengths, or request handling failures. The vulnerability has a CVSS score of 7.5 (High severity) with network-based exploitation requiring no authentication or user interaction, and a patch is available in version 1.19.2.

Technical ContextAI

The affected product is Qwik (cpe:2.3:a:qwikdev:qwik), a JavaScript framework that processes application/x-www-form-urlencoded and multipart/form-data requests through Qwik City's form handling layer. The vulnerability stems from CWE-843 (Access of Resource Using Incompatible Type or Type Confusion), where the framework's FormData parser improperly converts dotted field names into nested structures without adequately validating whether a path should be treated as an array versus an object. This allows attackers to pollute JavaScript array prototypes by injecting properties like toString, push, valueOf, or length onto paths intended to hold array elements, causing type confusion when downstream application code operates on these structures expecting standard array behavior.

RemediationAI

Upgrade Qwik to version 1.19.2 or later, which includes the fix implemented in commit 7b5867c3dd8925df9aa96c4296b1e95a4c2af87d (see https://github.com/QwikDev/qwik/commit/7b5867c3dd8925df9aa96c4296b1e95a4c2af87d). Organizations should review their package.json dependencies and update via npm or yarn package managers, then redeploy affected applications. The official security advisory at https://github.com/QwikDev/qwik/security/advisories/GHSA-whhv-gg5v-864r provides additional context and verification steps. Until patching is feasible, consider implementing input validation middleware to reject form submissions containing suspicious field names with prototype property names (toString, valueOf, push, length, constructor) or implementing web application firewall rules to block requests with these patterns, though upgrading remains the only complete mitigation.