CVE-2026-32701: Builder.io Qwik City array method pollution in FormData parsing

CVE-2026-32701 · Severity: low · CVSS 3.1 · Published 2026-03-20

Qwik City, a web framework for building server-rendered JavaScript applications, improperly processes form submissions containing dotted field names. An attacker can craft form submissions with mixed array and object keys that cause type confusion in the parsed data, leading to runtime errors, denial of service, or unexpected application behavior when the application trusts the data to be properly formatted arrays.

Technologies: Builder.Io Qwik-City, @builder.io/qwik-city (npm). Vendors: Builder.Io, npm.

Quick answers

Is CVE-2026-32701 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-32701 being exploited in the wild.
How severe is CVE-2026-32701?
Low severity, with a CVSS score of 3.1, published 20 March 2026.
Which products and versions are affected?
Builder.Io Qwik-City < 1.19.2; @builder.io/qwik-city (npm) SEMVER:introduced=0,fixed=1.19.2.
Is there a fix for CVE-2026-32701?
Yes. @builder.io/qwik-city (npm): upgrade to 1.19.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32701 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-32701?
Check whether you run Builder.Io Qwik-City or @builder.io/qwik-city (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @builder.io/qwik-city (npm): upgrade to 1.19.2 or later
    npm install @builder.io/qwik-city@1.19.2

Technical details

Qwik City's FormData parser converts dotted field names (e.g., items.0, items.1) into nested structures but fails to prevent array method pollution. An attacker can submit form fields with keys like items.toString, items.push, items.valueOf, or items.length on the same path as legitimate array indices, causing attacker-controlled properties to be written onto array-like objects. This is a type confusion vulnerability (CWE-843) exploitable via crafted application/x-www-form-urlencoded or multipart/form-data requests with no authentication required. Exploitation can trigger runtime errors when application code calls array methods, inflate array.length to cause DoS through memory exhaustion or malformed state, or confuse downstream application logic. The vulnerability affects Qwik City versions prior to 1.19.2, which contains the fix.

Affected products

  • Builder.io Qwik City < 1.19.2

Identifiers

  • CVE-2026-32701
  • GHSA-whhv-gg5v-864r

Timeline

  • 2026-03-20: disclosed
  • 2026-03-20: patched: Fixed in version 1.19.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.