# CVE-2026-25151: Qwik City CSRF bypass via Content-Type header validation

Source: https://junglewise.ai/threats/cve-2026-25151-qwik-city-csrf-bypass-via-content-type-header-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-25151 · Severity: low · CVSS 3.1 · Published 2026-02-03

Qwik City is a web framework for building fast, scalable applications. A vulnerability in its CSRF protection mechanism allows attackers to bypass security checks by manipulating HTTP Content-Type headers, potentially enabling unauthorized changes to application state. The attack requires specific CORS conditions and user interaction, but could lead to unauthorized form submissions and data modification on affected applications.

Technologies: [@builder.io/qwik-city (npm)](https://junglewise.ai/threats/technologies/builder-io-qwik-city). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-25151 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25151 being exploited in the wild.

**How severe is CVE-2026-25151?** Low severity, with a CVSS score of 3.1, published 3 February 2026.

**Which products and versions are affected?** @builder.io/qwik-city (npm) SEMVER:introduced=0,fixed=1.19.0.

**Is there a fix for CVE-2026-25151?** Yes. @builder.io/qwik-city (npm): upgrade to 1.19.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25151 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-25151?** Check whether you run @builder.io/qwik-city (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @builder.io/qwik-city (npm): upgrade to 1.19.0 or later

  ```sh
  npm install @builder.io/qwik-city@1.19.0
  ```


## Technical details

The vulnerability exists in Qwik City's checkCSRF function, which inconsistently interprets HTTP request headers when validating Origin-based CSRF checks. An attacker can circumvent CSRF protection by crafting or sending multi-valued Content-Type headers that are processed differently by the server than expected. Exploitation requires: (1) the CORS preflight request to succeed, (2) the application to accept cross-origin requests or be accessible via non-browser clients, and (3) user interaction. The attack vector is network-based with high complexity. A successful exploit can lead to unauthorized state changes, though actual impact depends on the target application's CORS and cookie policies. The vulnerability was patched in version 1.19.0.

## Affected products

- Builder.io @builder.io/qwik-city before 1.19.0

## Identifiers

- CVE-2026-25151
- GHSA-r666-8gjf-4v5f

## Timeline

- 2026-02-03: disclosed: Advisory published
- 2026-02-03: patched: Fixed in version 1.19.0

## References

- [https://github.com/QwikDev/qwik/security/advisories/GHSA-r666-8gjf-4v5f](https://github.com/QwikDev/qwik/security/advisories/GHSA-r666-8gjf-4v5f)

## Related threats

- [Builder.io Qwik City array method pollution in FormData parsing](https://junglewise.ai/threats/cve-2026-32701-builder-io-qwik-city-array-method-pollution-in-formdata-parsing)
- [Qwik City CSRF protection middleware regex parsing bypass](https://junglewise.ai/threats/cve-2026-25155-qwik-city-csrf-protection-middleware-regex-parsing-bypass)
- [Qwik City open redirect in fixTrailingSlash middleware](https://junglewise.ai/threats/cve-2026-25149-qwik-city-open-redirect-in-fixtrailingslash-middleware)
- [Builder.io Qwik City prototype pollution in form processing](https://junglewise.ai/threats/cve-2026-25150-builder-io-qwik-city-prototype-pollution-in-form-processing)
- [Qwik SSR XSS via unsafe virtual node serialization](https://junglewise.ai/threats/cve-2026-25148-qwik-ssr-xss-via-unsafe-virtual-node-serialization)