# CVE-2026-32701: Builder.io Qwik City array method pollution in FormData parsing

Source: https://junglewise.ai/threats/cve-2026-32701-builder-io-qwik-city-array-method-pollution-in-formdata-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-32701 · Severity: low · CVSS 3.1 · Published 2026-03-20

Qwik City, a web framework for building server-rendered JavaScript applications, improperly processes form submissions containing dotted field names. An attacker can craft form submissions with mixed array and object keys that cause type confusion in the parsed data, leading to runtime errors, denial of service, or unexpected application behavior when the application trusts the data to be properly formatted arrays.

Technologies: [Builder.Io Qwik-City](https://junglewise.ai/threats/technologies/qwik-city), [@builder.io/qwik-city (npm)](https://junglewise.ai/threats/technologies/builder-io-qwik-city). Vendors: [Builder.Io](https://junglewise.ai/threats/vendors/builder-io), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-32701 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32701 being exploited in the wild.

**How severe is CVE-2026-32701?** Low severity, with a CVSS score of 3.1, published 20 March 2026.

**Which products and versions are affected?** Builder.Io Qwik-City < 1.19.2; @builder.io/qwik-city (npm) SEMVER:introduced=0,fixed=1.19.2.

**Is there a fix for CVE-2026-32701?** Yes. @builder.io/qwik-city (npm): upgrade to 1.19.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-32701 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-32701?** Check whether you run Builder.Io Qwik-City or @builder.io/qwik-city (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @builder.io/qwik-city (npm): upgrade to 1.19.2 or later

  ```sh
  npm install @builder.io/qwik-city@1.19.2
  ```


## Technical details

Qwik City's FormData parser converts dotted field names (e.g., items.0, items.1) into nested structures but fails to prevent array method pollution. An attacker can submit form fields with keys like items.toString, items.push, items.valueOf, or items.length on the same path as legitimate array indices, causing attacker-controlled properties to be written onto array-like objects. This is a type confusion vulnerability (CWE-843) exploitable via crafted application/x-www-form-urlencoded or multipart/form-data requests with no authentication required. Exploitation can trigger runtime errors when application code calls array methods, inflate array.length to cause DoS through memory exhaustion or malformed state, or confuse downstream application logic. The vulnerability affects Qwik City versions prior to 1.19.2, which contains the fix.

## Affected products

- Builder.io Qwik City < 1.19.2

## Identifiers

- CVE-2026-32701
- GHSA-whhv-gg5v-864r

## Timeline

- 2026-03-20: disclosed
- 2026-03-20: patched: Fixed in version 1.19.2

## References

- [https://github.com/QwikDev/qwik/security/advisories/GHSA-whhv-gg5v-864r](https://github.com/QwikDev/qwik/security/advisories/GHSA-whhv-gg5v-864r)

## Related threats

- [Qwik City CSRF protection middleware regex parsing bypass](https://junglewise.ai/threats/cve-2026-25155-qwik-city-csrf-protection-middleware-regex-parsing-bypass)
- [Qwik City open redirect in fixTrailingSlash middleware](https://junglewise.ai/threats/cve-2026-25149-qwik-city-open-redirect-in-fixtrailingslash-middleware)
- [Qwik City CSRF bypass via Content-Type header validation](https://junglewise.ai/threats/cve-2026-25151-qwik-city-csrf-bypass-via-content-type-header-validation)
- [Builder.io Qwik City prototype pollution in form processing](https://junglewise.ai/threats/cve-2026-25150-builder-io-qwik-city-prototype-pollution-in-form-processing)
- [Qwik SSR XSS via unsafe virtual node serialization](https://junglewise.ai/threats/cve-2026-25148-qwik-ssr-xss-via-unsafe-virtual-node-serialization)