{"id":"GHSA-vm6g-8r4h-22x8","summary":"Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)","details":"### Summary\nA typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers.\n\n### Impact\nAn attacker can bypass Qwik City’s Origin-based CSRF protections and perform forged form submissions, potentially causing unauthorized state changes.","aliases":["CVE-2026-25155"],"modified":"2026-02-11T15:03:51.313099Z","published":"2026-02-03T20:59:18Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-02-03T20:59:18Z","nvd_published_at":"2026-02-03T22:16:30Z","cwe_ids":["CWE-352"]},"references":[{"type":"WEB","url":"https://github.com/QwikDev/qwik/security/advisories/GHSA-vm6g-8r4h-22x8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25155"},{"type":"WEB","url":"https://github.com/QwikDev/qwik/commit/d70d7099b90b998f1aac7cedc21c67d87bac4c75"},{"type":"PACKAGE","url":"https://github.com/QwikDev/qwik"}],"affected":[{"package":{"name":"@builder.io/qwik-city","ecosystem":"npm","purl":"pkg:npm/%40builder.io/qwik-city"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.12.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-vm6g-8r4h-22x8/GHSA-vm6g-8r4h-22x8.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N"}]}