# CVE-2026-25155: Qwik City CSRF protection middleware regex parsing bypass

Source: https://junglewise.ai/threats/cve-2026-25155-qwik-city-csrf-protection-middleware-regex-parsing-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-25155 · Severity: low · CVSS 3.1 · Published 2026-02-03

Qwik City is a framework for building web applications with CSRF (cross-site request forgery) protection built into its middleware. A typo in a regular expression causes the CSRF protection to fail when processing HTTP requests with parameterized Content-Type headers like "multipart/form-data; boundary=...". An attacker can exploit this to forge state-changing requests on behalf of authenticated users, potentially modifying their data or triggering unwanted actions.

Technologies: [@builder.io/qwik-city (npm)](https://junglewise.ai/threats/technologies/builder-io-qwik-city). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-25155 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25155 being exploited in the wild.

**How severe is CVE-2026-25155?** Low severity, with a CVSS score of 3.1, published 3 February 2026.

**Which products and versions are affected?** @builder.io/qwik-city (npm) SEMVER:introduced=0,fixed=1.12.0.

**Is there a fix for CVE-2026-25155?** Yes. @builder.io/qwik-city (npm): upgrade to 1.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25155 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-25155?** Check whether you run @builder.io/qwik-city (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @builder.io/qwik-city (npm): upgrade to 1.12.0 or later

  ```sh
  npm install @builder.io/qwik-city@1.12.0
  ```


## Technical details

A typo in the isContentType regular expression causes incorrect parsing of Content-Type headers that include parameters (e.g., "multipart/form-data; boundary=xyz"). This allows the CSRF protection middleware to fail to properly validate the Origin header for such requests. The vulnerability requires the attacker to trick a user into clicking a malicious link or submitting a form, but does not require elevated privileges. An attacker can craft a forged form submission that bypasses Origin-based CSRF checks, leading to unauthorized state changes. The vulnerability was fixed in version 1.12.0 and earlier versions (prior to 1.12.0) are affected.

## Affected products

- BuilderIO qwik-city < 1.12.0

## Identifiers

- CVE-2026-25155
- GHSA-vm6g-8r4h-22x8

## Timeline

- 2026-02-03: disclosed
- 2026-02-03: patched: Fix released in version 1.12.0

## References

- [https://github.com/QwikDev/qwik/security/advisories/GHSA-vm6g-8r4h-22x8](https://github.com/QwikDev/qwik/security/advisories/GHSA-vm6g-8r4h-22x8)

## Related threats

- [Builder.io Qwik City array method pollution in FormData parsing](https://junglewise.ai/threats/cve-2026-32701-builder-io-qwik-city-array-method-pollution-in-formdata-parsing)
- [Qwik City open redirect in fixTrailingSlash middleware](https://junglewise.ai/threats/cve-2026-25149-qwik-city-open-redirect-in-fixtrailingslash-middleware)
- [Qwik City CSRF bypass via Content-Type header validation](https://junglewise.ai/threats/cve-2026-25151-qwik-city-csrf-bypass-via-content-type-header-validation)
- [Builder.io Qwik City prototype pollution in form processing](https://junglewise.ai/threats/cve-2026-25150-builder-io-qwik-city-prototype-pollution-in-form-processing)
- [Qwik SSR XSS via unsafe virtual node serialization](https://junglewise.ai/threats/cve-2026-25148-qwik-ssr-xss-via-unsafe-virtual-node-serialization)