Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Qwik is a performance focused javascript framework. Prior to version 1.19.0, Qwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission CSRF protections using specially crafted or multi-valued Content-Type headers. This issue has been patched in version 1.19.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-25151 Qwik is a performance focused javascript framework. Prior to version 1.19.0, Qwik City’s server-side request handler inconsistently interprets HTTP request headers, w… https://www.cve.org/CVERecord?id=CVE-2026-25151
Post summary
A new CVE (CVE‑2026‑25151) has been announced for the Qwik framework, indicating that prior to version 1.19.0 its server‑side request handler incorrectly parses HTTP request headers.
CVE-2026-25151 Qwik City CSRF Bypass Vulnerability via Inconsistent Content-Type Header Parsing https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25151
Post summary
The text announces CVE-2026-25151, detailing a CSRF bypass flaw in Qwik City caused by inconsistent Content-Type parsing, without providing PoC, exploitation, or mitigation information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | qwik | qwik | - | node.js | - |