Is CVE-2026-25151 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25151 being exploited in the wild.

How severe is CVE-2026-25151?

Low severity, with a CVSS score of 3.1, published 3 February 2026.

Which products and versions are affected?

@builder.io/qwik-city (npm) SEMVER:introduced=0,fixed=1.19.0.

Is there a fix for CVE-2026-25151?

Yes. @builder.io/qwik-city (npm): upgrade to 1.19.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-25151 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-25151?

Check whether you run @builder.io/qwik-city (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25151: Qwik City CSRF bypass via Content-Type header validation

CVE-2026-25151 · Severity: low · CVSS 3.1 · Published 2026-02-03

Qwik City is a web framework for building fast, scalable applications. A vulnerability in its CSRF protection mechanism allows attackers to bypass security checks by manipulating HTTP Content-Type headers, potentially enabling unauthorized changes to application state. The attack requires specific CORS conditions and user interaction, but could lead to unauthorized form submissions and data modification on affected applications.

Technologies: @builder.io/qwik-city (npm). Vendors: npm.

Quick answers

Is CVE-2026-25151 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25151 being exploited in the wild.
How severe is CVE-2026-25151?: Low severity, with a CVSS score of 3.1, published 3 February 2026.
Which products and versions are affected?: @builder.io/qwik-city (npm) SEMVER:introduced=0,fixed=1.19.0.
Is there a fix for CVE-2026-25151?: Yes. @builder.io/qwik-city (npm): upgrade to 1.19.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25151 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-25151?: Check whether you run @builder.io/qwik-city (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@builder.io/qwik-city (npm): upgrade to 1.19.0 or later
```
npm install @builder.io/qwik-city@1.19.0
```

Technical details

The vulnerability exists in Qwik City's checkCSRF function, which inconsistently interprets HTTP request headers when validating Origin-based CSRF checks. An attacker can circumvent CSRF protection by crafting or sending multi-valued Content-Type headers that are processed differently by the server than expected. Exploitation requires: (1) the CORS preflight request to succeed, (2) the application to accept cross-origin requests or be accessible via non-browser clients, and (3) user interaction. The attack vector is network-based with high complexity. A successful exploit can lead to unauthorized state changes, though actual impact depends on the target application's CORS and cookie policies. The vulnerability was patched in version 1.19.0.

Affected products

Builder.io @builder.io/qwik-city before 1.19.0

Identifiers

CVE-2026-25151
GHSA-r666-8gjf-4v5f

Timeline

2026-02-03: disclosed: Advisory published
2026-02-03: patched: Fixed in version 1.19.0

References

https://github.com/QwikDev/qwik/security/advisories/GHSA-r666-8gjf-4v5f

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.