Executive brief
Qwik City is a framework for building web applications with CSRF (cross-site request forgery) protection built into its middleware. A typo in a regular expression causes the CSRF protection to fail when processing HTTP requests with parameterized Content-Type headers like "multipart/form-data; boundary=...". An attacker can exploit this to forge state-changing requests on behalf of authenticated users, potentially modifying their data or triggering unwanted actions.
Technical details
A typo in the isContentType regular expression causes incorrect parsing of Content-Type headers that include parameters (e.g., "multipart/form-data; boundary=xyz"). This allows the CSRF protection middleware to fail to properly validate the Origin header for such requests. The vulnerability requires the attacker to trick a user into clicking a malicious link or submitting a form, but does not require elevated privileges. An attacker can craft a forged form submission that bypasses Origin-based CSRF checks, leading to unauthorized state changes. The vulnerability was fixed in version 1.12.0 and earlier versions (prior to 1.12.0) are affected.
Affected products
- BuilderIO qwik-city < 1.12.0
Timeline
- 2026-02-03: disclosed
- 2026-02-03: patched: Fix released in version 1.12.0