Is CVE-2026-25155 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25155 being exploited in the wild.

How severe is CVE-2026-25155?

Low severity, with a CVSS score of 3.1, published 3 February 2026.

Which products and versions are affected?

@builder.io/qwik-city (npm) SEMVER:introduced=0,fixed=1.12.0.

Is there a fix for CVE-2026-25155?

Yes. @builder.io/qwik-city (npm): upgrade to 1.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-25155 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-25155?

Check whether you run @builder.io/qwik-city (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25155: Qwik City CSRF protection middleware regex parsing bypass

CVE-2026-25155 · Severity: low · CVSS 3.1 · Published 2026-02-03

Qwik City is a framework for building web applications with CSRF (cross-site request forgery) protection built into its middleware. A typo in a regular expression causes the CSRF protection to fail when processing HTTP requests with parameterized Content-Type headers like "multipart/form-data; boundary=...". An attacker can exploit this to forge state-changing requests on behalf of authenticated users, potentially modifying their data or triggering unwanted actions.

Technologies: @builder.io/qwik-city (npm). Vendors: npm.

Quick answers

Is CVE-2026-25155 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25155 being exploited in the wild.
How severe is CVE-2026-25155?: Low severity, with a CVSS score of 3.1, published 3 February 2026.
Which products and versions are affected?: @builder.io/qwik-city (npm) SEMVER:introduced=0,fixed=1.12.0.
Is there a fix for CVE-2026-25155?: Yes. @builder.io/qwik-city (npm): upgrade to 1.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25155 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-25155?: Check whether you run @builder.io/qwik-city (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@builder.io/qwik-city (npm): upgrade to 1.12.0 or later
```
npm install @builder.io/qwik-city@1.12.0
```

Technical details

A typo in the isContentType regular expression causes incorrect parsing of Content-Type headers that include parameters (e.g., "multipart/form-data; boundary=xyz"). This allows the CSRF protection middleware to fail to properly validate the Origin header for such requests. The vulnerability requires the attacker to trick a user into clicking a malicious link or submitting a form, but does not require elevated privileges. An attacker can craft a forged form submission that bypasses Origin-based CSRF checks, leading to unauthorized state changes. The vulnerability was fixed in version 1.12.0 and earlier versions (prior to 1.12.0) are affected.

Affected products

BuilderIO qwik-city < 1.12.0

Identifiers

CVE-2026-25155
GHSA-vm6g-8r4h-22x8

Timeline

2026-02-03: disclosed
2026-02-03: patched: Fix released in version 1.12.0

References

https://github.com/QwikDev/qwik/security/advisories/GHSA-vm6g-8r4h-22x8

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.