5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25151

CVE-2026-25151: Qwik City has a CSRF Protection Bypass via Content-Type Header Validation

Qwik is a performance focused javascript framework. Prior to version 1.19.0, Qwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission CSRF protections using specially crafted or multi-valued Content-Type headers. This issue has been patched in version 1.19.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25151

CVE-2026-25151:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@builder.io/qwik-city	npm	< 1.19.0	1.19.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a CSRF protection bypass in Qwik City, caused by inconsistent and flawed parsing of the Content-Type HTTP header. The core of the issue lies in the checkCSRF and isContentType functions within packages/qwik-city/src/middleware/request-handler/resolve-request-handlers.ts.

The checkCSRF function, which is intended to prevent cross-site request forgery attacks on form submissions, relied on the isContentType function to determine if a request had a content type typically used for forms (e.g., application/x-www-form-urlencoded, multipart/form-data, text/plain).

The original isContentType function was vulnerable in two ways:

It performed a case-sensitive comparison of the content type.
It only split the Content-Type header value by a semicolon (;), ignoring commas (,).

This allowed an attacker to bypass the CSRF check by sending a request with a crafted Content-Type header, such as application/x-www-form-urlencoded, application/json or using different casing like Application/X-WWW-Form-Urlencoded. The isContentType function would fail to correctly identify it as a form submission, and consequently, checkCSRF would not perform the necessary origin check, allowing the malicious request to proceed.

Additionally, the parseRequest function in packages/qwik-city/src/middleware/request-handler/request-event.ts used a different logic to parse the Content-Type header, leading to the inconsistent interpretation mentioned in the advisory.

The patch addresses this vulnerability by:

Introducing a new getContentType function that normalizes the Content-Type header by converting it to lowercase and splitting by both comma and semicolon.
Updating isContentType to use this new robust function and perform a case-insensitive check.
Modifying checkCSRF to correctly identify simple requests that require CSRF protection.
Updating parseRequest to use getContentType for consistent header interpretation across the application.

Vulnerable functions

checkCSRF

packages/qwik-city/src/middleware/request-handler/resolve-request-handlers.ts

This function is responsible for performing the CSRF check. The vulnerability lies in the fact that the check could be bypassed. The logic for determining when to apply the CSRF check was flawed because it relied on the `isContentType` function which incorrectly parsed the `Content-Type` header. An attacker could craft a header to make `isContentType` return `false`, thus bypassing the check within `checkCSRF`.

isContentType

packages/qwik-city/src/middleware/request-handler/resolve-request-handlers.ts

This function is responsible for checking the `Content-Type` of a request. The original implementation was vulnerable because it did not handle multi-valued `Content-Type` headers correctly (it only split by semicolon, not comma) and it was case-sensitive. This allowed an attacker to craft a `Content-Type` header that would bypass the CSRF check in the `checkCSRF` function.

parseRequest

packages/qwik-city/src/middleware/request-handler/request-event.ts

This function also parsed the `Content-Type` header. The vulnerability description mentions "inconsistently interprets HTTP request headers". This function used a different parsing logic (`split(/[;,]/, 1)`) than the original `isContentType` (`split(/;/, 1)`). While not the primary vulnerable function, this inconsistency is part of the overall problem that the patch addresses by centralizing the logic into `getContentType`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.