5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25155

CVE-2026-25155: [qwik-city] CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)

Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers. This issue has been patched in version 1.12.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25155

CVE-2026-25155:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@builder.io/qwik-city	npm	< 1.12.0	1.12.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided commit patch pinpoints the exact location of the vulnerability. The commit d70d7099b90b998f1aac7cedc21c67d87bac4c75 clearly shows a one-character change in the isContentType function inside packages/qwik-city/src/middleware/request-handler/resolve-request-handlers.ts. The regular expression used to split the 'content-type' header was corrected from /;,/ to /;/. This typo caused the CSRF protection mechanism to fail for certain content types (e.g., multipart/form-data), as the header was not parsed correctly. The vulnerability is confined to this function, which is responsible for checking the request's content type. An exploit would involve sending a request with a crafted Content-Type header that the vulnerable version of the function would misinterpret, thereby bypassing the server's CSRF defenses.

Vulnerable functions

isContentType

packages/qwik-city/src/middleware/request-handler/resolve-request-handlers.ts

The vulnerability is caused by a typo in the regular expression within the `isContentType` function. The incorrect regex `/;,/` fails to properly parse `Content-Type` headers that include parameters, such as `multipart/form-data; boundary=...`. This leads to an incorrect content type being evaluated, allowing an attacker to bypass the CSRF protection that relies on this check.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.