CVE-2026-25151: Qwik Framework CSRF Vulnerability

CVE-2026-25151 Overview

CVE-2026-25151 is a Cross-Site Request Forgery (CSRF) protection bypass vulnerability affecting Qwik, a performance-focused JavaScript framework. The vulnerability exists in Qwik City's server-side request handler, which inconsistently interprets HTTP request headers. A remote attacker can exploit this flaw to circumvent form submission CSRF protections by crafting specially formatted or multi-valued Content-Type headers.

Critical Impact

Attackers can bypass CSRF protections to perform unauthorized actions on behalf of authenticated users, potentially leading to account compromise, data manipulation, or privilege escalation.

Affected Products

• Qwik versions prior to 1.19.0
• Qwik City middleware request handler
• Applications using Qwik City's built-in CSRF protection mechanisms

Discovery Timeline

• 2026-02-03 - CVE-2026-25151 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2026-25151

Vulnerability Analysis

This vulnerability stems from inconsistent Content-Type header parsing in Qwik City's CSRF protection middleware. The original implementation checked for "simple request" content types (application/x-www-form-urlencoded, multipart/form-data, text/plain) to determine whether to enforce CSRF origin validation. However, the parsing logic could be manipulated through specially crafted Content-Type headers, allowing attackers to bypass the protection entirely.

The flaw is classified under CWE-352 (Cross-Site Request Forgery), where the web application does not sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Root Cause

The root cause lies in the checkCSRF function within resolve-request-handlers.ts. The original implementation only applied CSRF checks when a form-based Content-Type was detected. This logic failed to account for scenarios where:

1. No Content-Type header is present
2. Malformed or multi-valued Content-Type headers are submitted
3. Content-Type headers with additional parameters or unusual formatting bypass the simple check

The fix addresses this by inverting the logic—now treating requests without a Content-Type header, or with "simple request" content types, as requiring CSRF validation.

Attack Vector

The attack is network-based and requires user interaction (the victim must visit a malicious page while authenticated). An attacker can craft a malicious webpage that submits a forged request to the vulnerable Qwik application. By manipulating the Content-Type header in ways that bypass the original parsing logic, the attacker can make requests that evade CSRF protection while still being processed by the server.

// Security patch in resolve-request-handlers.ts
// Source: https://github.com/QwikDev/qwik/commit/eebf610e04cc3a690f11e10191d09ff0fca1c7ed

 function csrfCheckMiddleware(requestEv: RequestEvent) {
   checkCSRF(requestEv);
 }
-function checkCSRF(requestEv: RequestEvent, laxProto?: 'lax-proto') {
-  const isForm = isContentType(
-    requestEv.request.headers,
-    'application/x-www-form-urlencoded',
-    'multipart/form-data',
-    'text/plain'
-  );
-  if (isForm) {
+export function checkCSRF(requestEv: RequestEvent, laxProto?: 'lax-proto') {
+  const contentType = requestEv.request.headers.get('content-type');
+
+  const isSimpleRequest =
+    !contentType ||
+    isContentType(
+      requestEv.request.headers,
+      'application/x-www-form-urlencoded',
+      'multipart/form-data',
+      'text/plain'
+    );
+
+  if (isSimpleRequest) {
     const inputOrigin = requestEv.request.headers.get('origin');
     const origin = requestEv.url.origin;
     let forbidden = inputOrigin !== origin;

Detection Methods for CVE-2026-25151

Indicators of Compromise

• Unusual HTTP requests with missing or malformed Content-Type headers targeting form submission endpoints
• Requests with multi-valued Content-Type headers in server access logs
• Cross-origin requests to state-changing endpoints that bypass normal CSRF token validation
• Increased form submissions from unexpected referrers or without proper Origin headers

Detection Strategies

• Monitor web server logs for requests with unusual Content-Type header patterns, including empty values, multiple values, or unexpected parameters
• Implement Web Application Firewall (WAF) rules to detect and alert on malformed Content-Type headers
• Review authentication logs for suspicious account activity that may indicate successful CSRF exploitation
• Deploy anomaly detection on form submission endpoints to identify unusual request patterns

Monitoring Recommendations

• Enable verbose logging for the Qwik City request handler middleware to capture Content-Type header values
• Set up alerts for state-changing requests that originate from unexpected origins
• Monitor for exploitation attempts by tracking requests with missing or null Content-Type headers to sensitive endpoints
• Implement request integrity monitoring to detect potential CSRF attack patterns

How to Mitigate CVE-2026-25151

Immediate Actions Required

• Upgrade Qwik to version 1.19.0 or later immediately
• Audit application logs for any suspicious activity that may indicate prior exploitation
• Review any custom CSRF protection implementations that may have similar Content-Type parsing issues
• Consider implementing additional defense-in-depth measures such as SameSite cookies

Patch Information

The vulnerability has been patched in Qwik version 1.19.0. The fix modifies the checkCSRF function to properly handle edge cases in Content-Type header parsing. The patch ensures CSRF validation is applied to all "simple requests" as defined by CORS, including requests without a Content-Type header. For detailed patch information, see the GitHub Commit and GitHub Security Advisory.

Workarounds

• If immediate upgrade is not possible, implement additional server-side CSRF token validation independent of Qwik City's built-in protection
• Deploy a reverse proxy or WAF rule to normalize Content-Type headers before they reach the application
• Implement strict SameSite cookie attributes (SameSite=Strict or SameSite=Lax) to provide defense-in-depth against CSRF attacks
• Add custom middleware to explicitly validate Origin headers for all state-changing requests

# Update Qwik to patched version
npm update @builder.io/qwik @builder.io/qwik-city

# Or install specific patched version
npm install @builder.io/qwik@1.19.0 @builder.io/qwik-city@1.19.0

# Verify installed version
npm list @builder.io/qwik