Executive brief
Qwik City, a web framework for building server-rendered JavaScript applications, improperly processes form submissions containing dotted field names. An attacker can craft form submissions with mixed array and object keys that cause type confusion in the parsed data, leading to runtime errors, denial of service, or unexpected application behavior when the application trusts the data to be properly formatted arrays.
Technical details
Qwik City's FormData parser converts dotted field names (e.g., items.0, items.1) into nested structures but fails to prevent array method pollution. An attacker can submit form fields with keys like items.toString, items.push, items.valueOf, or items.length on the same path as legitimate array indices, causing attacker-controlled properties to be written onto array-like objects. This is a type confusion vulnerability (CWE-843) exploitable via crafted application/x-www-form-urlencoded or multipart/form-data requests with no authentication required. Exploitation can trigger runtime errors when application code calls array methods, inflate array.length to cause DoS through memory exhaustion or malformed state, or confuse downstream application logic. The vulnerability affects Qwik City versions prior to 1.19.2, which contains the fix.
Affected products
- Builder.io Qwik City < 1.19.2
Timeline
- 2026-03-20: disclosed
- 2026-03-20: patched: Fixed in version 1.19.2