El middleware de protección CSRF de Qwik City no funciona correctamente para encabezados de tipo de contenido con parámetros (ej. multipart/form-data)

The primary impact of CVE-2026-25155 is the circumvention of Qwik City's CSRF protections. An attacker could craft malicious requests that appear to originate from a legitimate user, tricking the application into performing actions on their behalf. This could include modifying user profiles, creating new accounts, or executing other sensitive operations. The blast radius is limited to the functionality exposed through Qwik City forms and actions, but the potential for unauthorized data manipulation and account takeover is significant. This vulnerability highlights the importance of robust input validation and proper header parsing in web applications.

Applications built with @builder.io/qwik-city and using its Origin-based CSRF protection mechanisms are at risk. This includes projects relying on Qwik City for form handling and state management. Shared hosting environments where multiple applications share the same server resources could also be indirectly affected if one application is compromised.

• nodejs / server: Examine application logs for unusual form submissions or requests with unexpected Content-Type headers. Use lsof or ss to monitor for suspicious network connections originating from the Qwik City process.

lsof -i :3000 | grep -i qwik

• generic web: Monitor access logs for requests with manipulated Content-Type headers. Inspect response headers for unexpected behavior after form submissions.

 grep -i "Content-Type: application/x-www-form-urlencoded" /var/log/nginx/access.log

1. 2026-02-03Disclosure

   disclosure

1. Reservado2026-01-29
2. Publicada2026-02-03
3. Modificada2026-02-11
4. EPSS actualizado2026-03-23

The recommended mitigation for CVE-2026-25155 is to immediately upgrade to @builder.io/qwik-city version 1.12.0 or later. This version contains a corrected regular expression that properly parses Content-Type headers, effectively preventing the CSRF bypass. If upgrading is not immediately feasible, consider implementing stricter Origin checks in your application code to further reinforce CSRF protection. While not a complete solution, this can provide an additional layer of defense. Review and validate all form submissions to ensure they originate from trusted sources. After upgrading, confirm the fix by attempting to submit a forged form request and verifying that the Origin check is enforced.